diff --git a/SCOPE.md b/SCOPE.md
index 897cc3b..dd8237e 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -1,114 +1,169 @@
 # SCOPE
 
-Reviewed 2026-09-05 against repository source, dated operating evidence and
-adjacent owner contracts. This is a scope assessment, not a fresh live audit.
-[INTENT.md](INTENT.md) remains the stable aspiration.
+> This file helps you quickly understand what this repository is about,
+> when it is relevant, and when it is not.
+> It is intentionally lightweight and may be incomplete.
 
-## Purpose and boundary
+---
 
-Railiance's S3 shared stateful services: database provision and placement,
-secret custody and delivery, and platform-data backup and recovery behind
-versioned consumer interfaces. Cache, general object storage and messaging
-remain demand-led capabilities; their inclusion in INTENT does not mean they
-are deployed or justify running them without consumers.
+## One-liner
 
-S3 owns the service promise, custody and acceptance evidence. A `rapp-*` repo
-owns its deployable package; the cluster and host owners supply the runtime.
-Identity integration means consuming identity claims, not operating an identity
-or authorization authority. See [ADR-0001](docs/adr/ADR-0001-s3-platform-service-boundary.md).
+S3 Platform Services layer of the Railiance OAS Stack — owns shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.
 
-## Current evidenced capability
+---
 
-| Service | Implemented / evidenced | Limit and authority |
-| --- | --- | --- |
-| `apps-pg` | CNPG source, per-consumer database ACLs, 20-connection allowances, 15-second timeouts; daily backup, continuous WAL and 30-day retention; 56-second scratch restore and 14/14 boundary probes on 2026-08-20 | One instance; restart recovery, no HA or measured latency SLO. Ceiling 3, overflow `apps-pg-2` provisionable but demand-gated. S3 owns this CR and its controls. |
-| `platform-pg` | Package-operated CNPG service, governed dynamic credentials, backup/restore evidence, Core Hub admission and private shadow evidence | `rapp-postgres` owns CR/provisioning/restore. S3 owns custody, placement policy and consumer disclosure. Published ceiling 4 declarations, counting the probe; reconcile current occupancy before admission. One instance is not HA. |
-| OpenBao and credential delivery | CCR validation, policy/grant boundaries, approved apply interfaces, runtime KV/ESO and short-lived database lanes, ephemeral custody lifecycle | Package assets belong to `rapp-openbao`; custody/policy remains here. Existing helpers are not authority to mint arbitrary credentials. Operator-only access cutover and incident residuals remain open. |
-| Backup storage consumption | Governed off-cluster S3 backup destination and credential lane used by CNPG; encrypted upload tooling for other backup consumers | Resource procurement belongs to `resource-control`/`reef-storage`. This does not establish a general S3 service or deployed MinIO. One successful restore does not establish a recurring recovery guarantee. |
-| Cache / general object storage / messaging | Valkey deployment is gated; no supported consumer interface or deployed shared broker/general in-cluster object store is established by this review | Demand, reuse, ownership, service contract and recovery design must precede deployment. No engine/provider choice is made here. |
+## Core Idea
 
-Evidence and contracts: [consumer interfaces](docs/s3-consumer-interfaces.md),
-[apps-pg restore](docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md),
-[apps-pg isolation](docs/evidence/RPF-WP-0019-isolation-2026-08-20.md),
-[placement](docs/placement-policy.md), [tenancy](tenancy.yaml), and
-[Core Hub capacity admission](docs/evidence/core-hub-postgres-capacity-admission-2026-08-20.md).
-The former “apps-pg has no backup” and “both ceilings missing” scope statements
-were stale. Dated evidence above must not be presented as current health.
+Railiance classifies repos along four orthogonal axes — `railiance-*`
+(ownership), `rail-*` (execution contract), `rapp-*` (managed workload package),
+`reef-*` (substrate boundary). This repo is `railiance-*`, at **S3** on the OAS
+Stack dimension: the platform services that multiple applications share. Five
+repos cover S1–S5; other `railiance-*` repos sit on other OAS dimensions rather
+than on the stack. See `ArchitectureBlueprint.md` for the full backbone.
 
-## Responsibility split
+The database operator is CloudNative PG. Bitnami postgresql-ha is retired
+(no live release; `make pg-deploy` fail-closed, `RAILIANCE-WP-0016` item 14).
+Valkey is a declared capability with no live instance and nothing left in S2
+to extract; `make valkey-deploy` is gated until a consumer rapp exists.
 
-| S3 retains | Other owner / handoff |
-| --- | --- |
-| Database service placement, custody and acceptance | `rapp-postgres`: package, admission enforcement and restore; consumers: schemas, migrations, workload SLOs and app verification |
-| OpenBao service custody, ACL/role review, approved delivery and revocation proof | `rapp-openbao`: package; `key-cape`/`net-kingdom`: issuer, OIDC/MFA, directory/provider reconciliation |
-| Platform acceptance of a credential lane | `secrets-engine`: lifecycle engine; `ops-mason`: construction coordination through engine APIs; `flex-auth`/access-engine and `approval-engine`: decisions and approval consumption |
-| Service health semantics, recovery expectations and evidence production | `railiance-telemetry`: Q2 collection, retention and alert transport; it is not S3's monitoring implementation to build |
-| Platform snapshot/unseal/readiness contribution to an outage | `railiance-infra`: host/reboot; `railiance-cluster`: Kubernetes/restart; consumer owner: synthetic load and application acceptance |
-| Database/object-store/credential interfaces consumed by the forge | `railiance-forge`: forge backup orchestration, artifact retention and pruning; `activity-core`: automation execution |
-| Scope accuracy and file-backed source records | `railiance-master`: fleet taxonomy and Q3 placement; `repo-manager`/State Hub: derived record identity and projection correctness |
+OpenBao is a platform capability in this repo, but not every OpenBao-related
+file belongs in the long-term S3 ownership home. The deployable package surface
+now has a wave-1 repo home in `rapp-openbao`, while this repo retains custody,
+policy, and lane governance.
 
-DNS, host firewall, TLS/ingress primitives, Kubernetes runtime, CI templates,
-application releases, business logic and identity/authorization decisions are
-outside S3. Existing Forgejo helpers, ArgoCD bootstrap/application manifests,
-and OpenBao package compatibility assets are retained migration surfaces, not
-an expansion of that boundary. Transfer requires an accepting owner and tested
-replacement entry points; source files are not deleted merely to tidy scope.
+---
 
-## Work that closes the intent gaps
+## In Scope
 
-The [current work index](workplans/README.md) groups six open workplans.
-The [full assessment](history/2026-09-05-platform-intent-workplan-assessment.md)
-records every reviewed plan and the consolidation mapping.
+- PostgreSQL via CloudNative PG operator (cnpg) — operator deployed, `databases` namespace active
+- Valkey / Redis-compatible cache as a standalone Helm release (to be extracted from S2)
+- Secret management infrastructure (OpenBao as the platform service,
+  SOPS/age for Git-at-rest bootstrap material)
+- Identity services integration point (with net-kingdom)
+- Message brokers (RabbitMQ, similar)
+- Object storage (MinIO / S3-compatible)
+- Backup and recovery services for platform data
 
-| Priority | Gap | Canonical work |
-| --- | --- | --- |
-| First | Reported credential exposures need final disposition and dependable operator custody | RPF-WP-0027: KeyCape/NetKingdom residual evidence and S3 custody; RPF-WP-0029: provider invalidation and replacement backup recovery |
-| First | Private attended OpenBao access remains unproven end to end | RPF-WP-0025-T03; keep its window separate from incident/recovery actions |
-| Next | Recovery procedures exist, but two cross-owner exercises still lack completion evidence | RPF-WP-0015-T02/T03: S3 contribution, with audit-core and S1/S2 executing their own parts |
-| Next | Three requested credential lanes have designs but no live acceptance | RPF-WP-0035: one queue with separate consumer/issuer/approval gates |
-| Next | Numeric availability/recovery promises, evidence freshness, recurring drills, emission and admission drift lack a complete S3 acceptance loop | RPF-WP-0036-T02–T05 |
-| Next | Compatibility ownership, stale Hub aliases, and undeployed capability demand need explicit disposition | RPF-WP-0036-T06/T07 |
+---
 
-The ready work in RPF-WP-0036 can proceed while attended operations wait.
-It must define achievable promises for the existing single-node substrate,
-not declare HA through documentation. Any stronger availability target needs
-an S1/S2 dependency and a package-level failover proof. Fleet-wide Q3 ownership
-is an architecture question; it does not suspend S3's own recovery obligations.
+## Out of Scope
 
-## Provided capabilities
+- OS-level concerns → railiance-infra (S1)
+- Kubernetes runtime → railiance-cluster (S2)
+- Developer tooling, CI/CD → railiance-enablement (S4)
+- Application deployments → railiance-apps (S5)
+- Standalone workload-package ownership for OpenBao deployment assets -> `rapp-openbao`, while S3 retains secrets custody and policy
+- No re-configuration of S1/S2 concerns from this repo
+
+---
+
+## Relevant When
+
+- Deploying or managing shared services that multiple S5 applications depend on
+- Extracting platform services from application Helm subcharts (boundary enforcement)
+- S2 cluster is operational and platform layer can now be established
+- Defining which OpenBao concerns are workload package assets versus retained platform governance
+
+---
+
+## Not Relevant When
+
+- S2 (cluster runtime) is not yet operational (pre-condition not met)
+- Application-specific database schemas or migrations (those belong in S5 apps)
+- Infrastructure or cluster work (wrong layer)
+
+---
+
+## Current State
+
+- Status: maintained / emerging
+- Implementation: CloudNative PG operator live; `databases` namespace holds the platform clusters; OpenBao is the S3 secrets service. Bitnami postgresql-ha is retired. Valkey is undeployed.
+- Stability: emerging — CNPG clusters are live; cache and in-cluster object storage are not
+- Usage: shared database and secrets layer; cnpg-system, databases, and openbao namespaces are live
+- Deploys via ArgoCD: four Applications (`external-secrets`, `issue-core`,
+  `openbao-secretstore`, `target-revenue`) plus AppProjects under
+  `argocd/bootstrap/`; see `docs/argocd-gitops.md`
+- Emits to `railiance-telemetry` (Q2 Observability) once the evidence plane
+  exists — seeded 2026-08-11, not yet implemented
+- Open work: Valkey remains a declared-but-unbuilt cache; MinIO is likewise
+  declared, not deployed. OpenBao package boundary and PAT cutover are
+  closed. Platform rapp declarations conform (`RAILIANCE-WP-0015`).
+  Versioned consumer interfaces: `docs/s3-consumer-interfaces.md`.
+  Tenancy posture and database placement policy are declared
+  (`docs/tenancy-posture.md`, `docs/placement-policy.md`, `RPF-WP-0018`).
+  Two open items they surfaced: `apps-pg` has no backup configured, and
+  both shared clusters owe a declared consumer ceiling before their third
+  consumer. Decisions are now recorded as ADRs in `docs/adr/` (ADR-0003).
+- Known drift: State Hub attributes ~11 capabilities to this repo, including
+  S1/S2/S4/S5 concerns it does not own. The four `capability` blocks in this
+  file are authoritative; the hub carries stale pre-split attributions
+  (`ArchitectureBlueprint.md` C1)
+
+---
+
+## How It Fits
+
+- Upstream dependencies: railiance-cluster (S2) — k3s running, Helm available, smoke tests passing
+- Downstream consumers: railiance-enablement (S4), railiance-apps (S5) — all depend on platform services
+- Often used with: net-kingdom (identity services integration), railiance-cluster (prior layer)
+- Emits to: railiance-telemetry (evidence plane) — S3 services are expected to
+  emit health and readiness through the standard emission contract rather than
+  per-service bespoke integrations
+- Structural backbone: `ArchitectureBlueprint.md` in this repo records the four
+  repo-family axes, the stack, repository status, and the open placement
+  decisions that `railiance-master` owns
+
+---
+
+## Terminology
+
+- Preferred terms: OAS Stack Level S3, platform services, boundary rule, migration (extracting from S2 subcharts)
+- Potentially confusing terms: "migration" here means moving Helm releases between layers, not database schema migration; `rapp-openbao` packages OpenBao, but it does not own platform custody or policy
+
+---
+
+## Related / Overlapping
+
+- `railiance-cluster` (S2) — pre-condition; PostgreSQL was previously managed here (being extracted to S3)
+- `railiance-apps` (S5) — consumes database and cache services from S3
+- `net-kingdom` — identity services integration point at the platform layer
+
+---
+
+## Provided Capabilities
 
 ```capability
 type: infrastructure
 title: PostgreSQL via CloudNative PG (cnpg)
-description: Shared database service and placement policy with apps-pg controls and rapp-postgres package integration. Current evidenced deployments are single-instance; HA is not established.
+description: PostgreSQL database clusters managed by the CloudNative PG operator — shared database service for all platform applications. Operator deployed in cnpg-system namespace; database clusters defined in the databases namespace.
 keywords: [postgresql, postgres, cnpg, cloudnative-pg, operator, database, kubernetes]
 ```
 
 ```capability
 type: infrastructure
 title: Valkey / Redis-compatible cache
-description: Declared shared cache capability, not a supported live service. Deployment stays gated on an accepted consumer and service contract.
+description: Declared shared Redis-compatible cache. Not deployed on railiance01 as of 2026-08-15; no S2 instance remains to extract.
 keywords: [valkey, redis, cache, shared, session, queue]
 ```
 
 ```capability
 type: data
 title: Object storage (MinIO / S3-compatible)
-description: Governed external S3 backup-storage consumption exists. A general shared object-storage service, including in-cluster MinIO, remains undeployed and demand-gated.
+description: S3-compatible object storage service (MinIO) for artifact storage, backups, and large file handling across platform applications.
 keywords: [minio, s3, object-storage, storage, artifacts, backup]
 ```
 
 ```capability
 type: security
 title: OpenBao platform secrets service
-description: S3 custody, policy and approved runtime credential delivery; package assets belong to rapp-openbao. SOPS/age supports bootstrap custody. New lanes need independent live acceptance.
+description: Canonical S3 secrets service for runtime secrets, dynamic credentials, audit, and future workload integrations. SOPS/age remains the bootstrap mechanism for Git-at-rest secrets.
 keywords: [openbao, secrets, vault-compatible, secret-management, dynamic-credentials, audit, kubernetes-auth]
 ```
 
-## Getting oriented
+---
 
-Read [AGENTS.md](AGENTS.md), [INTENT.md](INTENT.md), then
-[workplans/README.md](workplans/README.md). Completed plans are preserved under
-`workplans/archived/`; [WORK-RECORDS.md](WORK-RECORDS.md) is the generated current
-index (archives omitted). Routine sync follows AGENTS.md. The dated `.custodian-brief.md` and Hub
-legacy aliases are not additional authoritative obligations.
+## Getting Oriented
+
+- Start with: `CLAUDE.md` (session protocol, boundary rules)
+- Key files / directories: `workplans/RAIL-PL-WP-0001-platform-baseline.md`, `workplans/RAIL-PL-WP-0002-openbao-platform-secrets-service.md`, `helm/` (platform Helm charts), `docs/openbao.md`, `Makefile`
+- Pre-conditions: railiance-cluster (S2) converged with k3s running; cluster backup verified before migration steps (`sudo make backup` in railiance-cluster)
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 5aa346c..81d7962 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -8,35 +8,161 @@
 
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
-| workplan | RPF-WP-0015 | blocked | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| workplan | RPF-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | RPF-WP-0001 | finished | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| workplan | RPF-WP-0002 | finished | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| workplan | RPF-WP-0003 | finished | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| workplan | RPF-WP-0004 | finished | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| workplan | RPF-WP-0005 | finished | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
+| workplan | RPF-WP-0006 | finished | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
+| workplan | RPF-WP-0007 | finished | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
+| workplan | RPF-WP-0008 | finished | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
+| workplan | RPF-WP-0009 | finished | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| workplan | RPF-WP-0010 | finished | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
+| workplan | RPF-WP-0011 | finished | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| workplan | RPF-WP-0012 | finished | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md |
+| workplan | RPF-WP-0013 | finished | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| workplan | RPF-WP-0014 | finished | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
+| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| workplan | RPF-WP-0016 | finished | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| workplan | RPF-WP-0017 | finished | — | workplans/RPF-WP-0017-attended-login-output-containment.md |
+| workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
 | workplan | RPF-WP-0025 | blocked | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
-| workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| workplan | RPF-WP-0026 | finished | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
+| workplan | RPF-WP-0027 | active | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| workplan | RPF-WP-0028 | finished | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
 | workplan | RPF-WP-0029 | blocked | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
-| workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
-| workplan | RPF-WP-0036 | ready | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| workplan | RPF-WP-0030 | finished | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| workplan | RPF-WP-0031 | finished | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
+| workplan | RPF-WP-0032 | blocked | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
+| workplan | RPF-WP-0033 | blocked | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
+| workplan | RPF-WP-0034 | blocked | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
+| task | RPF-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | RPF-WP-ADHOC-2026-08-23-T02 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | RPF-WP-0001-T01 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T02 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T03 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T04 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T05 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T06 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T07 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T08 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T09 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0001-T10 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
+| task | RPF-WP-0002-T01 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| task | RPF-WP-0002-T02 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| task | RPF-WP-0002-T03 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| task | RPF-WP-0002-T04 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| task | RPF-WP-0002-T05 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
+| task | RPF-WP-0003-T01 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T02 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T03 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T04 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T05 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T06 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0003-T07 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
+| task | RPF-WP-0004-T01 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T02 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T03 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T04 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T05 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T06 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T07 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0004-T08 | cancel | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
+| task | RPF-WP-0005-T01 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
+| task | RPF-WP-0005-T02 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
+| task | RPF-WP-0005-T03 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
+| task | RPF-WP-0005-T04 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
+| task | RPF-WP-0006-T01 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
+| task | RPF-WP-0006-T02 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
+| task | RPF-WP-0006-T03 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
+| task | RPF-WP-0006-T04 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
+| task | RPF-WP-0007-T01 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
+| task | RPF-WP-0007-T02 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
+| task | RPF-WP-0007-T03 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
+| task | RPF-WP-0007-T04 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
+| task | RPF-WP-0008-T01 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
+| task | RPF-WP-0008-T02 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
+| task | RPF-WP-0008-T03 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
+| task | RPF-WP-0008-T04 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
+| task | RPF-WP-0009-T01 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0009-T02 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0009-T03 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0009-T04 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0009-T05 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0009-T06 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
+| task | RPF-WP-0010-T01 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
+| task | RPF-WP-0010-T02 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
+| task | RPF-WP-0010-T03 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
+| task | RPF-WP-0011-T01 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| task | RPF-WP-0011-T02 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| task | RPF-WP-0011-T03 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| task | RPF-WP-0011-T04 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| task | RPF-WP-0011-T05 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
+| task | RPF-WP-0012-T01 | done | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md |
+| task | RPF-WP-0013-T01 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0013-T02 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0013-T03 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0013-T04 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0013-T05 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0013-T06 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
+| task | RPF-WP-0014-T01 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
+| task | RPF-WP-0014-T02 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
+| task | RPF-WP-0014-T03 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
 | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
-| task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
-| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0015-T02 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0015-T03 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0016-T01 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0016-T02 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0016-T03 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0016-T04 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0016-T05 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0016-T06 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
+| task | RPF-WP-0017-T01 | done | — | workplans/RPF-WP-0017-attended-login-output-containment.md |
+| task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T04 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T05 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T06 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0018-T07 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
+| task | RPF-WP-0019-T01 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| task | RPF-WP-0019-T02 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| task | RPF-WP-0019-T03 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| task | RPF-WP-0019-T04 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| task | RPF-WP-0020-T01 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T02 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T03 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T04 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
 | task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
 | task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
 | task | RPF-WP-0025-T03 | wait | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
+| task | RPF-WP-0026-T01 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
+| task | RPF-WP-0026-T02 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
+| task | RPF-WP-0026-T03 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
 | task | RPF-WP-0027-T01 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
 | task | RPF-WP-0027-T02 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
-| task | RPF-WP-0027-T03 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
-| task | RPF-WP-0027-T04 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T03 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T04 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
 | task | RPF-WP-0027-T05 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
-| task | RPF-WP-0027-T06 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T06 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0028-T01 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
+| task | RPF-WP-0028-T02 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
 | task | RPF-WP-0029-T01 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
 | task | RPF-WP-0029-T02 | wait | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
-| task | RPF-WP-0035-T01 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
-| task | RPF-WP-0035-T02 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
-| task | RPF-WP-0035-T03 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
-| task | RPF-WP-0035-T04 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
-| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T02 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T03 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T04 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T05 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T06 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0036-T07 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0030-T01 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| task | RPF-WP-0030-T02 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| task | RPF-WP-0030-T03 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| task | RPF-WP-0030-T04 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| task | RPF-WP-0030-T05 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
+| task | RPF-WP-0031-T01 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
+| task | RPF-WP-0031-T02 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
+| task | RPF-WP-0032-T01 | done | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
+| task | RPF-WP-0032-T02 | wait | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
+| task | RPF-WP-0033-T01 | done | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
+| task | RPF-WP-0033-T02 | wait | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
+| task | RPF-WP-0034-T01 | done | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
+| task | RPF-WP-0034-T02 | wait | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
diff --git a/docs/credential-lane-designs/README.md b/docs/credential-lane-designs/README.md
index 9acfbbf..d63a7f1 100644
--- a/docs/credential-lane-designs/README.md
+++ b/docs/credential-lane-designs/README.md
@@ -4,15 +4,14 @@ Reviewed against local owner source on 2026-09-05. These are proposed designs,
 not approvals or executable CCRs. No live credentials or OpenBao objects were
 created. Files here are deliberately outside the production CCR/policy scan.
 
-| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
+| Design | Owning platform workplan | Consumer dependency | Main unresolved input |
 | --- | --- | --- | --- |
-| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
-| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
-| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
+| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
+| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
+| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 | STATE-WP-0085-T09 | Deployment binding, owner-approved custody and rotation window |
 
-The completed design workplans are archived. RPF-WP-0035 is the canonical
-queue for owner review, implementation, and live acceptance still required.
-State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
+Each workplan separates completed design work from the owner review,
+implementation, and live acceptance still required. Proposed object names can
 be reviewed now; none represents a surveyed or active object. Before any secret
 or access request, use `warden route find` / `warden route show` as required by
 AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,
diff --git a/docs/credential-lane-designs/state-hub-preflight-signing.md b/docs/credential-lane-designs/state-hub-preflight-signing.md
index 6309bde..2e808f5 100644
--- a/docs/credential-lane-designs/state-hub-preflight-signing.md
+++ b/docs/credential-lane-designs/state-hub-preflight-signing.md
@@ -102,13 +102,3 @@ For a non-compromise failed deployment, keep operations fenced and restore the
 prior chart/key version only with owner approval, then verify all replicas.
 Keep protected historical KV versions until the retention decision; no automatic
 destroy, provider rename, or weakening of preflight checks is part of this lane.
-
-## Demand review — 2026-09-05
-
-STATE-WP-0085-T09 completed its adoption-plan deliverable on 2026-08-31.
-The still-proposed FLEX-WP-0020-T05 cutover carries the signing prerequisite.
-State Hub is now explicitly transitional in its INTENT; State Hub/repo-manager
-and the migration owner must confirm the target runtime and continued need
-before provisioning this design. RPF-WP-0035-T04 is the current platform task;
-RPF-WP-0034 is the archived design record. No demand withdrawal or activation
-is inferred from retirement planning alone.
diff --git a/history/2026-09-05-platform-intent-workplan-assessment.md b/history/2026-09-05-platform-intent-workplan-assessment.md
deleted file mode 100644
index b8fa5b5..0000000
--- a/history/2026-09-05-platform-intent-workplan-assessment.md
+++ /dev/null
@@ -1,269 +0,0 @@
-# Railiance Platform intent, scope and workplan assessment — 2026-09-05
-
-## Conclusion
-
-The backlog mostly serves INTENT, but its presentation confused completed
-implementation, waiting live acceptance, and work belonging to other owners.
-The largest missing part of the intent is a continuing service-assurance loop:
-clear promises, fresh recovery evidence, monitored capacity and observable
-failure. It is not a lack of additional credential designs or a reason to
-install every aspirational stateful service.
-
-The review starts from platform commit `9d958f8e09a057d6ad688dc77001368b5feea029`.
-It covers all 37 file-backed workplans and 168 task records, with detailed
-inspection of every unfinished task, its source contracts and available owner
-updates. Completed records were triaged by deliverable/boundary, not recertified
-as current production health. The scope of work is assessment and consolidation;
-no credentials were read, no live infrastructure changed, no external messages
-sent, and no transfer acceptance was fabricated. INTENT is unchanged.
-
-## What changed
-
-Before: 29 finished plans, 2 active, 5 blocked, 1 archived; 31 files at the
-workplan root, including 24 already finished. Task states: 150 done, 7 wait,
-4 progress, 1 cancel and 6 historical `cancelled` tasks in the retired baseline.
-Those legacy task spellings are preserved rather than silently rewriting the
-historical baseline.
-
-After: 32 finished plans, 5 blocked, 1 ready, 1 archived (39 records total).
-Only six current workplans remain at the root; 27 completed plans moved to
-`workplans/archived/260905-*` with their IDs and managed UUIDs intact. No source
-record was deleted. The three design plans finish because their design work is
-delivered and each implementation task is explicitly superseded in RPF-WP-0035.
-They do not claim live lane completion. RPF-WP-0036 adds the missing assurance
-work with six actionable follow-ups rather than six more umbrella workplans.
-
-The number of blocked plans remains five: three lane waits became one queue,
-and two apparently active plans were corrected to blocked because their
-remaining work waits on owners/live windows. A smaller number achieved by
-marking unperformed live work done would hide obligations, not consolidate them.
-
-`SCOPE.md` now describes actual service boundaries, dated evidence and unsupported
-guarantees. `workplans/README.md` is the short current queue. The accompanying
-[inventory](2026-09-05-platform-workplan-inventory.json) preserves before/after
-statuses, task dispositions, source revisions and every archive path.
-
-## Important findings
-
-### 1. Two claimed platform gaps were already closed
-
-SCOPE said apps-pg had no backup and both shared clusters lacked ceilings.
-RPF-WP-0019 and its 2026-08-20 evidence show daily backup/continuous WAL,
-30-day retention, a 56-second scratch restore, 14/14 isolation/control probes,
-and a three-consumer apps-pg ceiling with a provisionable overflow cell.
-The consumer interface records platform-pg's four-declaration ceiling.
-
-Evidence: [apps-pg restore](../docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md),
-[isolation](../docs/evidence/RPF-WP-0019-isolation-2026-08-20.md), and
-[interfaces](../docs/s3-consumer-interfaces.md). These are dated proofs, not a
-fresh claim about backup age today. Do not reopen the completed bootstrap work.
-
-### 2. Recovery/availability promises remain weaker than the aspiration
-
-Both published shared database interfaces declare one instance and no HA.
-CNPG's presence is not a multi-node availability guarantee. Database restore
-artifacts exist; the examined OpenBao snapshot/preparation receipts and restore
-templates do not establish a current recurring isolated-restore guarantee.
-The earlier reboot returned the same PVC and is not proof of node-loss recovery.
-
-S3 needs per-service accepted availability/RPO/RTO, retention and evidence-age
-budgets, recovery custody/operator availability, and recurring proof of restore.
-No numeric promise should be invented from one elapsed-time observation.
-RPF-WP-0036-T02/T03 closes this gap while preserving the two specific pending
-experiments in RPF-WP-0015. Fleet Q3 ownership remains for railiance-master;
-S3 cannot use that uncertainty to decline its own recovery responsibility.
-
-### 3. The security incident records need evidence reconciliation, not another rotation
-
-KEY-WP-0011 is finished and NK-WP-0033-T04 records the bundle replacement.
-Platform RPF-WP-0027-T04 was stale; it is now done by that existing owner evidence.
-NK-WP-0033's 2026-08-27 update also records the resolver binding reconciliation,
-but no complete green receipt and no retained predecessor for the negative test.
-T03/T05/T06 remain waiting on current evidence disposition and exact custody.
-The incident owner must decide how the missing predecessor proof is treated;
-manual observations cannot be promoted into a fabricated receipt.
-
-Provider/resolver/MFA verification belongs to NetKingdom and KeyCape; S3 owns
-custody and its acceptance. RPF-WP-0029 remains a separate, high-priority backup
-credential exposure until provider invalidation and replacement recovery are
-proved. Neither a source fix nor this consolidation closes an exposure.
-
-### 4. Observability is a shared dependency with a retained S3 obligation
-
-`docs/placement-policy.md` labels capacity monitoring unmonitored. The reviewed
-railiance-telemetry source is still seeded and owns the standard emission and
-transport contract. Platform must define what its service signals mean, emit
-safe metadata, and prove a failed/stale check reaches a named recipient. It
-should not build a second monitoring plane, nor mark emission complete because
-another repo has not delivered the receiver. RPF-WP-0036-T04 makes this split
-and its end-to-end acceptance explicit.
-
-### 5. Consumer admission records drift even though their controls exist
-
-The placement policy mixes desired tenant-engine placement with statements of
-live co-residency and predates Core Hub admission. The interface and package
-source must be joined before deciding occupancy, overflow or retention impact.
-This is an evidence/disclosure gap, not permission to move workloads.
-RPF-WP-0036-T05 reconciles it using existing package admission checks.
-
-### 6. Credential designs fit S3, but their end-to-end applications do not
-
-The three new designs remain useful. Their platform-owned portions are custody,
-exact policy/auth bindings, delivery and negative verification. Issuer/JWKS,
-application CAS/session behavior, lifecycle/approval consumption, and runtime
-rotation fencing belong to their respective owners. RPF-WP-0035 is the single
-implementation queue, with separate gates for each lane.
-
-The signing demand has a material qualification: STATE-WP-0085-T09 finished its
-plan-generation scope on 2026-08-31. FLEX-WP-0020-T05 still needs signing for its
-proposed live rename. State Hub's INTENT now places it in retirement planning.
-Reconfirm the runtime and demand with State Hub/repo-manager and the consumer
-before creating another transitional secret lane. Do not infer demand is
-withdrawn merely because the service is transitional.
-
-### 7. Some operational code remains in the wrong long-term ownership home
-
-Forgejo pruning, image-inventory integration and backup orchestration belong
-with railiance-forge, using S3's custody/storage interfaces and activity-core's
-execution. OpenBao package wrappers belong to rapp-openbao. ArgoCD bootstrap,
-generic delivery paths and individual app manifests need S2/S4/S5 splits.
-These are retained compatibility assets; deleting or moving them without
-accepting owners and tested callers would break working operations.
-RPF-WP-0036-T06 carries a concrete acceptance-based handoff, not an assertion
-that delegation already happened. The old architecture backlog RPF-WP-0011
-stays closed; its unrelated fleet rows are not resurrected here.
-
-### 8. Aspirational services need demand decisions, not speculative deployment
-
-Cache, object storage and messaging fit INTENT. Valkey has no supported current
-consumer interface and its deployment is deliberately gated. External S3 backup
-consumption exists, so “no object storage” is too broad, while “MinIO provided”
-is also unsupported. No shared messaging service is established by this review.
-RPF-WP-0036-T07 must decide reuse, defer with a trigger, or accept a bounded
-consumer-backed delivery plan for each. Resource purchase/engine selection and
-provider deployment are not part of this assessment.
-
-## Ownership and handoff assessment
-
-These are recommended/respected responsibility boundaries, not newly accepted
-external assignments. Existing task references show where owner work already
-exists; missing acceptance stays a platform follow-up rather than disappearing.
-
-| Platform task/surface | Owner work elsewhere | What stays here / completion boundary |
-| --- | --- | --- |
-| RPF-WP-0015-T02 | audit-core AUDIT-WP-0008 synthetic load/app proof; rapp-postgres database acceptance | Lease/ESO preconditions and restart-free recovery evidence for the exact consumer; fresh live window |
-| RPF-WP-0015-T03 | railiance-infra reboot, railiance-cluster recovery, audit-core app proof; existing reviewed procedure receipts | Snapshot/custody/quorum/ESO/database readiness contribution, not whole-host execution ownership |
-| RPF-WP-0025-T03 | rapp-openbao RAPP-OPENBAO-WP-0002; net-kingdom NK-WP-0032; S1/S2 DNS/network; ops-bridge tunnel | Exact OpenBao callback and private attended access acceptance; source readiness does not prove cutover |
-| RPF-WP-0027-T03/T05 | KEY-WP-0011 delivered; NK-WP-0033-T03/T05 residual command/evidence disposition | Accept provider evidence; do not repeat its completed rotation or take over resolver operations |
-| RPF-WP-0027-T06 | NetKingdom operator handoff and eventual routing consumer | Canonical confirmed custody coordinates, scope, lifecycle and receipt |
-| RPF-WP-0029-T02 | Provider owner for invalidation; RAIL-HO-WP-0012 for S1 backup; railiance-forge for forge recovery | Governed replacement custody and accepted invalidation/upload/restore evidence |
-| RPF-WP-0035-T02 | KEY-WP-0009 issuer; SECRETS-WP-0008-T06 login and SECRETS-WP-0007-T04 apply authority | Exact JWT role/policy and custody acceptance, not lifecycle engine implementation |
-| RPF-WP-0035-T03 | MASON-WP-0005 construction; FT-WP-0002 client; IAM group/assurance owners | Operator-write CCR/validator and exact OpenBao scope; no Telegram application logic |
-| RPF-WP-0035-T04 | State Hub runtime/rotation, FLEX-WP-0020-T05 cutover, repo-manager retirement coordination | Confirm demand; scoped signing-key custody and delivery; no repository rename |
-| RPF-WP-0036-T04 | railiance-telemetry Q2 receiving/emission contract | S3 signal semantics and producer/receipt acceptance |
-| RPF-WP-0036-T06 | Forge/package/S2/S4/S5 accepting owners; repo-manager/State Hub derived records | Exact inventory, stable contracts, tested handoff; preserve responsibility until accepted |
-| RPF-WP-0036-T07 | Resource-control/reef-storage procurement; artifact-store existing surface; railiance-master Q3 placement | Demand/reuse review and S3 service obligations; no fleet architecture program here |
-
-## Task-level consolidation and status corrections
-
-| Source task | Disposition | Successor / reason |
-| --- | --- | --- |
-| RPF-WP-0032-T02 | wait → cancel (superseded) | RPF-WP-0035-T02; original JWT design preserved |
-| RPF-WP-0033-T02 | wait → cancel (superseded) | RPF-WP-0035-T03; original operator KV design preserved |
-| RPF-WP-0034-T02 | wait → cancel (superseded) | RPF-WP-0035-T04; original signing design preserved and demand qualified |
-| RPF-WP-0015-T02/T03 | progress → wait | Procedures prepared; live experiments/owner gates outstanding |
-| RPF-WP-0027-T03/T06 | progress → wait | Current evidence disposition and confirmed custody still outstanding |
-| RPF-WP-0027-T04 | wait → done | Existing KeyCape/NetKingdom owner-controlled replacement evidence; no new live act |
-| RPF-WP-0027-T05 | stays wait | Complete residual evidence/incident-owner disposition absent |
-| RPF-WP-0025-T03 | stays wait | Fresh attended callback/login and retraction proof absent |
-| RPF-WP-0029-T02 | stays wait | Provider invalidation and replacement recovery evidence absent |
-
-All other pre-existing task statuses are retained. No IDs or managed UUIDs are
-reassigned. Archive moves preserve identity; the JSON inventory records exact
-old/new paths. Historical evidence references keep their historical meaning;
-resolve moved records through the per-plan register below and the archive map.
-
-## Intent gap closure sequence
-
-1. Keep the two exposure residuals first in the attended queue: RPF-WP-0027
-   and RPF-WP-0029. Close by evidence/disposition, not by recreating old actions.
-2. In parallel with waiting for owners, begin RPF-WP-0036-T02 (service promises)
-   and T05 (admission/disclosure consistency). These have local work available.
-3. Finish private access under RPF-WP-0025, then schedule independent recovery
-   exercises under RPF-WP-0015 with fresh gates. No combined blanket approval.
-4. Implement recurring proof T03 and S3 emission T04 against owner contracts.
-5. Advance each RPF-WP-0035 lane only as its consumer/issuer/authority gates
-   clear. Revalidate the transitional signing demand first.
-6. Complete compatibility handoffs and capability demand decisions, T06/T07.
-   Do not build HA, cache, MinIO or a broker merely to make the scope sound full.
-
-## Derived-state caveat
-
-The start-of-session topic query included other financial-domain repositories;
-it is not a repo backlog. After filtering the actual platform repo UUID,
-two active legacy aliases remained alongside their canonical records:
-
-| Legacy Hub record | Canonical source record |
-| --- | --- |
-| `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`, `railiance-wp-0024@retired-20260826` | RPF-WP-0015, `f4640325-e89c-591d-b58e-ec6b087900ac` |
-| `038bc3c0-4492-5b91-95eb-ae515ca205df`, `railiance-wp-0029@retired-20260826` | RPF-WP-0027, `b2c25a01-4a80-55c1-90cf-8538000f7e0e` |
-
-The generated brief is dated 2026-08-26 and also repeats stale work. These are
-not additional file-backed tasks. RPF-WP-0036-T06 records the scoped derived
-cleanup dependency; no blanket retirement or managed UUID rewrite is justified.
-The fast sync receipt verifies the current pushed source projection; it must
-not be interpreted as proof that all historical alias views were repaired.
-
-## Review limitations and maintenance
-
-This is source/evidence review, not a live cluster, IAM, billing or service
-health audit. Sibling SCOPE files themselves sometimes lag owner workplans;
-newer dated task evidence takes precedence for the findings above. No previously
-approved live authority is renewed by a documentation edit. Existing unrelated
-history is unchanged. Revisit this assessment on an incident closure, consumer
-admission, telemetry contract availability or accepted service guarantee.
-
-The following per-plan register is generated from the captured before-inventory
-and reviewed disposition map, not from the stale Hub brief.
-
-## Disposition of all 37 original plans
-
-| Workplan | Before → after | Assessment |
-| --- | --- | --- |
-| [RPF-WP-ADHOC-2026-08-23](../workplans/archived/260905-ADHOC-2026-08-23.md) | finished → finished | Delivered tenancy evidence and broker test fixes; no residual project. |
-| [RPF-WP-0001](../workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md) | finished → finished | Delivered custody/grant broker; retain S3 policy, route future engine lifecycle to secrets-engine. |
-| [RPF-WP-0002](../workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md) | finished → finished | Delivered bounded delegated apply; S3 enforcement and approval boundary fit intent. |
-| [RPF-WP-0003](../workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md) | finished → finished | Delivered Issue Core runtime custody; app ingestion remains consumer-owned. |
-| [RPF-WP-0004](../workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md) | finished → finished | Delivered provider-key custody; provider/application lifecycle stays with its owner. |
-| [RPF-WP-0005](../workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md) | finished → finished | Delivered reuse-surface runtime custody; webhook application logic is consumer-owned. |
-| [RPF-WP-0006](../workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md) | finished → finished | Delivered OpenBao package boundary; compatibility handoff reviewed under 0036-T06. |
-| [RPF-WP-0007](../workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md) | finished → finished | Delivered PAT custody cutover; future pruning ownership belongs to railiance-forge. |
-| [RPF-WP-0008](../workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md) | finished → finished | Delivered CCR validation/test repair; keeps platform policy fail-closed. |
-| [RPF-WP-0009](../workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md) | finished → finished | Delivered S3 rapp/interface conventions; fleet family taxonomy stays with master. |
-| [RPF-WP-0010](../workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md) | finished → finished | Delivered apps-pg resource evidence; recurring freshness is 0036-T03/T04. |
-| [RPF-WP-0011](../workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md) | finished → finished | Delivered S3 architecture cleanup; unrelated fleet rows remain outside S3. |
-| [RPF-WP-0012](../workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md) | finished → finished | Delivered consumption-mode enforcement; consume policy, do not own commercial decisions. |
-| [RPF-WP-0013](../workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md) | finished → finished | Delivered agent high-risk deny coverage; retained S3 custody boundary. |
-| [RPF-WP-0014](../workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md) | finished → finished | Delivered hub-core candidate lanes; application migration stays with consumer/package. |
-| [RPF-WP-0015](../workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | active → blocked | Keep scoped recovery contribution; prepared procedures wait on fresh live gates. |
-| [RPF-WP-0016](../workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md) | finished → finished | Delivered ephemeral custody lifecycle; no unattended reaper authority implied. |
-| [RPF-WP-0017](../workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md) | finished → finished | Delivered output-containment repair; future drill still needs fresh acceptance. |
-| [RPF-WP-0018](../workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md) | finished → finished | Delivered tenancy/placement policy and ADR surface; ongoing drift is 0036-T05. |
-| [RPF-WP-0019](../workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md) | finished → finished | Delivered backup/controls/ceiling/isolation; correct stale SCOPE, do not reopen. |
-| [RPF-WP-0020](../workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md) | finished → finished | Delivered CCR migration/draft model; schema extension for new write lane is 0035-T03. |
-| [RPF-WP-0025](../workplans/RPF-WP-0025-openbao-operator-only-access.md) | blocked → blocked | Keep private access cutover; exact attended login, package and network gates. |
-| [RPF-WP-0026](../workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md) | finished → finished | Delivered canonical authorization consumption; PDP remains outside S3. |
-| [RPF-WP-0027](../workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | active → blocked | Narrow to custody/residual evidence; owner rotation already delivered; no repeat rotation. |
-| [RPF-WP-0028](../workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md) | finished → finished | Delivered durable inventory; future forge/automation handoff is 0036-T06. |
-| [RPF-WP-0029](../workplans/RPF-WP-0029-backup-credential-default-removal.md) | blocked → blocked | Keep provider invalidation/recovery evidence; source fallback removal alone is insufficient. |
-| [RPF-WP-0030](../workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md) | finished → finished | Delivered Core Hub onboarding; preserve distinct identity, reconcile disclosures in 0036-T05. |
-| [RPF-WP-0031](../workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md) | finished → finished | Delivered scoped identity repair; do not repeat or broaden UUID edits. |
-| [RPF-WP-0032](../workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T02. |
-| [RPF-WP-0033](../workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T03. |
-| [RPF-WP-0034](../workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T04; reconfirm transitional demand. |
-| [RAIL-PL-WP-0002](../workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md) | finished → finished | Historical secrets-service bootstrap; continuing assurance belongs to 0036, not reopened bootstrap. |
-| [RPF-WP-0021](../workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md) | finished → finished | Historical apps-pg bootstrap; stable identity preserved after previous collision repair. |
-| [RPF-WP-0022](../workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md) | finished → finished | Historical GitOps bootstrap; retained mixed ownership inventory goes to 0036-T06. |
-| [RPF-WP-0023](../workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md) | finished → finished | Delivered workload KV lane foundation; new demands use consolidated 0035. |
-| [RPF-WP-0024](../workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md) | finished → finished | Delivered CCR approval workflow; retain S3 policy and consume approval authority. |
-| [RAIL-PL-WP-0001](../workplans/archived/RAIL-PL-WP-0001-platform-baseline.md) | archived → archived | Retired baseline; six legacy cancelled tasks remain historical, not six open gaps. |
diff --git a/history/2026-09-05-platform-workplan-inventory.json b/history/2026-09-05-platform-workplan-inventory.json
deleted file mode 100644
index ac72844..0000000
--- a/history/2026-09-05-platform-workplan-inventory.json
+++ /dev/null
@@ -1,2183 +0,0 @@
-{
-  "review_date": "2026-09-05",
-  "basis": "source and dated evidence; no fresh live health audit",
-  "source_revisions": {
-    "railiance-platform": {
-      "head": "9d958f8e09a057d6ad688dc77001368b5feea029",
-      "working_tree_dirty": true
-    },
-    "railiance-telemetry": {
-      "head": "aa59e805ba218323eb19395484cd1c876684abfc",
-      "working_tree_dirty": false
-    },
-    "railiance-master": {
-      "head": "5ffd7d1b40d56249f490a318e728047fd3517c4c",
-      "working_tree_dirty": false
-    },
-    "railiance-infra": {
-      "head": "f3e8bf3ab4b1dafa4d0b251b88ab2ef23a30c37b",
-      "working_tree_dirty": false
-    },
-    "railiance-cluster": {
-      "head": "db7860ec2e2bda803d5bc6f0a467935e0d98697f",
-      "working_tree_dirty": false
-    },
-    "railiance-enablement": {
-      "head": "f91a5298cb9ad07b7bc9c488a7429f89c55f651d",
-      "working_tree_dirty": false
-    },
-    "railiance-forge": {
-      "head": "e395e5e9c196fe7cea9cd2be513554e493e675ee",
-      "working_tree_dirty": false
-    },
-    "rapp-openbao": {
-      "head": "89bc86b8aff549953ec744395ca47578aaac7591",
-      "working_tree_dirty": false
-    },
-    "rapp-postgres": {
-      "head": "2b7fe861f984f8539ca63ede662fe5719ace895a",
-      "working_tree_dirty": false
-    },
-    "net-kingdom": {
-      "head": "4e07d60ff17a0fe74c23d352aafaae08a809e413",
-      "working_tree_dirty": false
-    },
-    "key-cape": {
-      "head": "30fa8570aaff6e03c35617b265201b2ebf2c0094",
-      "working_tree_dirty": false
-    },
-    "secrets-engine": {
-      "head": "ebdff586fe60d165bc717f3fa1de8e037fd5502a",
-      "working_tree_dirty": false
-    },
-    "ops-mason": {
-      "head": "f920bcad1af688197c15417257b392aec42db9e7",
-      "working_tree_dirty": true
-    },
-    "state-hub": {
-      "head": "2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90",
-      "working_tree_dirty": true
-    },
-    "fluid-telegram": {
-      "head": "f7af151f37a7d652fe389daf43efc9be0d3e2bc0",
-      "working_tree_dirty": false
-    },
-    "audit-core": {
-      "head": "95dcb78e17d46889c17b55e3ba1aadbcceec6a99",
-      "working_tree_dirty": false
-    },
-    "flex-auth": {
-      "head": "56940727bfb36aec705318b0128599f367256c23",
-      "working_tree_dirty": false
-    },
-    "repo-manager": {
-      "head": "55002b6fc954bf6f61eeac20fb7d50d52aee7b75",
-      "working_tree_dirty": false
-    }
-  },
-  "before": [
-    {
-      "id": "RPF-WP-ADHOC-2026-08-23",
-      "path": "workplans/ADHOC-2026-08-23.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-ADHOC-2026-08-23-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-ADHOC-2026-08-23-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0001",
-      "path": "workplans/RPF-WP-0001-credential-request-and-lease-broker.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0001-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T08",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T09",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T10",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0002",
-      "path": "workplans/RPF-WP-0002-openbao-approved-automation-delegation.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0002-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0003",
-      "path": "workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0003-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0004",
-      "path": "workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0004-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T08",
-          "status": "cancel"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0005",
-      "path": "workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0005-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0006",
-      "path": "workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0006-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0007",
-      "path": "workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0007-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0008",
-      "path": "workplans/RPF-WP-0008-credential-change-suite-stabilization.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0008-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0009",
-      "path": "workplans/RPF-WP-0009-platform-rapp-consistency.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0009-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0010",
-      "path": "workplans/RPF-WP-0010-apps-pg-resource-evidence.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0010-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0010-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0010-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0011",
-      "path": "workplans/RPF-WP-0011-architecture-cleanup-backlog.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0011-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0012",
-      "path": "workplans/RPF-WP-0012-consumption-mode-enforcement.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0012-T01",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0013",
-      "path": "workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0013-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0014",
-      "path": "workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0014-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0014-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0014-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0015",
-      "path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md",
-      "status": "active",
-      "tasks": [
-        {
-          "id": "RPF-WP-0015-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0015-T02",
-          "status": "progress"
-        },
-        {
-          "id": "RPF-WP-0015-T03",
-          "status": "progress"
-        },
-        {
-          "id": "RPF-WP-0015-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0016",
-      "path": "workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0016-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0017",
-      "path": "workplans/RPF-WP-0017-attended-login-output-containment.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0017-T01",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0018",
-      "path": "workplans/RPF-WP-0018-policy-surface-alignment.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0018-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0019",
-      "path": "workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0019-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0020",
-      "path": "workplans/RPF-WP-0020-ccr-schema-drift.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0020-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0025",
-      "path": "workplans/RPF-WP-0025-openbao-operator-only-access.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0025-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0025-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0025-T03",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0026",
-      "path": "workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0026-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0026-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0026-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0027",
-      "path": "workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md",
-      "status": "active",
-      "tasks": [
-        {
-          "id": "RPF-WP-0027-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0027-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0027-T03",
-          "status": "progress"
-        },
-        {
-          "id": "RPF-WP-0027-T04",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0027-T05",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0027-T06",
-          "status": "progress"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0028",
-      "path": "workplans/RPF-WP-0028-durable-live-image-inventory.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0028-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0028-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0029",
-      "path": "workplans/RPF-WP-0029-backup-credential-default-removal.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0029-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0029-T02",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0030",
-      "path": "workplans/RPF-WP-0030-core-hub-platform-onboarding.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0030-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0031",
-      "path": "workplans/RPF-WP-0031-workplan-identity-collision.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0031-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0031-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0032",
-      "path": "workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0032-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0032-T02",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0033",
-      "path": "workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0033-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0033-T02",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0034",
-      "path": "workplans/RPF-WP-0034-state-hub-preflight-signing-design.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0034-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0034-T02",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RAIL-PL-WP-0002",
-      "path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RAIL-PL-WP-0002-T01",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T02",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T03",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T04",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T05",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T06",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0021",
-      "path": "workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0021-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0022",
-      "path": "workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0022-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0023",
-      "path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0023-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0024",
-      "path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0024-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T08",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T09",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RAIL-PL-WP-0001",
-      "path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md",
-      "status": "archived",
-      "tasks": [
-        {
-          "id": "RAIL-PL-WP-0001-T01",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T02",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T03",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T04",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T05",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T06",
-          "status": "cancelled"
-        }
-      ]
-    }
-  ],
-  "after": [
-    {
-      "id": "RPF-WP-0015",
-      "path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0015-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0015-T02",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0015-T03",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0015-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0025",
-      "path": "workplans/RPF-WP-0025-openbao-operator-only-access.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0025-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0025-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0025-T03",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0027",
-      "path": "workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0027-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0027-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0027-T03",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0027-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0027-T05",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0027-T06",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0029",
-      "path": "workplans/RPF-WP-0029-backup-credential-default-removal.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0029-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0029-T02",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0035",
-      "path": "workplans/RPF-WP-0035-credential-lane-implementation.md",
-      "status": "blocked",
-      "tasks": [
-        {
-          "id": "RPF-WP-0035-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0035-T02",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0035-T03",
-          "status": "wait"
-        },
-        {
-          "id": "RPF-WP-0035-T04",
-          "status": "wait"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0036",
-      "path": "workplans/RPF-WP-0036-platform-service-assurance.md",
-      "status": "ready",
-      "tasks": [
-        {
-          "id": "RPF-WP-0036-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0036-T02",
-          "status": "todo"
-        },
-        {
-          "id": "RPF-WP-0036-T03",
-          "status": "todo"
-        },
-        {
-          "id": "RPF-WP-0036-T04",
-          "status": "todo"
-        },
-        {
-          "id": "RPF-WP-0036-T05",
-          "status": "todo"
-        },
-        {
-          "id": "RPF-WP-0036-T06",
-          "status": "todo"
-        },
-        {
-          "id": "RPF-WP-0036-T07",
-          "status": "todo"
-        }
-      ]
-    },
-    {
-      "id": "RAIL-PL-WP-0002",
-      "path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RAIL-PL-WP-0002-T01",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T02",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T03",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T04",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T05",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T06",
-          "status": "done"
-        },
-        {
-          "id": "RAIL-PL-WP-0002-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0021",
-      "path": "workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0021-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0021-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0022",
-      "path": "workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0022-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0022-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0023",
-      "path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0023-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0023-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0024",
-      "path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0024-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T08",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0024-T09",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-ADHOC-2026-08-23",
-      "path": "workplans/archived/260905-ADHOC-2026-08-23.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-ADHOC-2026-08-23-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-ADHOC-2026-08-23-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0001",
-      "path": "workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0001-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T08",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T09",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0001-T10",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0002",
-      "path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0002-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0002-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0003",
-      "path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0003-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0003-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0004",
-      "path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0004-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T07",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0004-T08",
-          "status": "cancel"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0005",
-      "path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0005-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0005-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0006",
-      "path": "workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0006-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0006-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0007",
-      "path": "workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0007-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0007-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0008",
-      "path": "workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0008-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0008-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0009",
-      "path": "workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0009-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0009-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0010",
-      "path": "workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0010-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0010-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0010-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0011",
-      "path": "workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0011-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0011-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0012",
-      "path": "workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0012-T01",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0013",
-      "path": "workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0013-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0013-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0014",
-      "path": "workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0014-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0014-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0014-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0016",
-      "path": "workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0016-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0016-T06",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0017",
-      "path": "workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0017-T01",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0018",
-      "path": "workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0018-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T05",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T06",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0018-T07",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0019",
-      "path": "workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0019-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0019-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0020",
-      "path": "workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0020-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0020-T04",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0026",
-      "path": "workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0026-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0026-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0026-T03",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0028",
-      "path": "workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0028-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0028-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0030",
-      "path": "workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0030-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T02",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T03",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T04",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0030-T05",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0031",
-      "path": "workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0031-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0031-T02",
-          "status": "done"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0032",
-      "path": "workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0032-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0032-T02",
-          "status": "cancel"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0033",
-      "path": "workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0033-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0033-T02",
-          "status": "cancel"
-        }
-      ]
-    },
-    {
-      "id": "RPF-WP-0034",
-      "path": "workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md",
-      "status": "finished",
-      "tasks": [
-        {
-          "id": "RPF-WP-0034-T01",
-          "status": "done"
-        },
-        {
-          "id": "RPF-WP-0034-T02",
-          "status": "cancel"
-        }
-      ]
-    },
-    {
-      "id": "RAIL-PL-WP-0001",
-      "path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md",
-      "status": "archived",
-      "tasks": [
-        {
-          "id": "RAIL-PL-WP-0001-T01",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T02",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T03",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T04",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T05",
-          "status": "cancelled"
-        },
-        {
-          "id": "RAIL-PL-WP-0001-T06",
-          "status": "cancelled"
-        }
-      ]
-    }
-  ],
-  "dispositions": {
-    "RPF-WP-0001": "Delivered custody/grant broker; retain S3 policy, route future engine lifecycle to secrets-engine.",
-    "RPF-WP-0002": "Delivered bounded delegated apply; S3 enforcement and approval boundary fit intent.",
-    "RPF-WP-0003": "Delivered Issue Core runtime custody; app ingestion remains consumer-owned.",
-    "RPF-WP-0004": "Delivered provider-key custody; provider/application lifecycle stays with its owner.",
-    "RPF-WP-0005": "Delivered reuse-surface runtime custody; webhook application logic is consumer-owned.",
-    "RPF-WP-0006": "Delivered OpenBao package boundary; compatibility handoff reviewed under 0036-T06.",
-    "RPF-WP-0007": "Delivered PAT custody cutover; future pruning ownership belongs to railiance-forge.",
-    "RPF-WP-0008": "Delivered CCR validation/test repair; keeps platform policy fail-closed.",
-    "RPF-WP-0009": "Delivered S3 rapp/interface conventions; fleet family taxonomy stays with master.",
-    "RPF-WP-0010": "Delivered apps-pg resource evidence; recurring freshness is 0036-T03/T04.",
-    "RPF-WP-0011": "Delivered S3 architecture cleanup; unrelated fleet rows remain outside S3.",
-    "RPF-WP-0012": "Delivered consumption-mode enforcement; consume policy, do not own commercial decisions.",
-    "RPF-WP-0013": "Delivered agent high-risk deny coverage; retained S3 custody boundary.",
-    "RPF-WP-0014": "Delivered hub-core candidate lanes; application migration stays with consumer/package.",
-    "RPF-WP-0015": "Keep scoped recovery contribution; prepared procedures wait on fresh live gates.",
-    "RPF-WP-0016": "Delivered ephemeral custody lifecycle; no unattended reaper authority implied.",
-    "RPF-WP-0017": "Delivered output-containment repair; future drill still needs fresh acceptance.",
-    "RPF-WP-0018": "Delivered tenancy/placement policy and ADR surface; ongoing drift is 0036-T05.",
-    "RPF-WP-0019": "Delivered backup/controls/ceiling/isolation; correct stale SCOPE, do not reopen.",
-    "RPF-WP-0020": "Delivered CCR migration/draft model; schema extension for new write lane is 0035-T03.",
-    "RPF-WP-0021": "Historical apps-pg bootstrap; stable identity preserved after previous collision repair.",
-    "RPF-WP-0022": "Historical GitOps bootstrap; retained mixed ownership inventory goes to 0036-T06.",
-    "RPF-WP-0023": "Delivered workload KV lane foundation; new demands use consolidated 0035.",
-    "RPF-WP-0024": "Delivered CCR approval workflow; retain S3 policy and consume approval authority.",
-    "RPF-WP-0025": "Keep private access cutover; exact attended login, package and network gates.",
-    "RPF-WP-0026": "Delivered canonical authorization consumption; PDP remains outside S3.",
-    "RPF-WP-0027": "Narrow to custody/residual evidence; owner rotation already delivered; no repeat rotation.",
-    "RPF-WP-0028": "Delivered durable inventory; future forge/automation handoff is 0036-T06.",
-    "RPF-WP-0029": "Keep provider invalidation/recovery evidence; source fallback removal alone is insufficient.",
-    "RPF-WP-0030": "Delivered Core Hub onboarding; preserve distinct identity, reconcile disclosures in 0036-T05.",
-    "RPF-WP-0031": "Delivered scoped identity repair; do not repeat or broaden UUID edits.",
-    "RPF-WP-0032": "Design delivered; implementation T02 superseded by 0035-T02.",
-    "RPF-WP-0033": "Design delivered; implementation T02 superseded by 0035-T03.",
-    "RPF-WP-0034": "Design delivered; implementation T02 superseded by 0035-T04; reconfirm transitional demand.",
-    "RPF-WP-ADHOC-2026-08-23": "Delivered tenancy evidence and broker test fixes; no residual project.",
-    "RAIL-PL-WP-0002": "Historical secrets-service bootstrap; continuing assurance belongs to 0036, not reopened bootstrap.",
-    "RAIL-PL-WP-0001": "Retired baseline; six legacy cancelled tasks remain historical, not six open gaps."
-  },
-  "archive_moves": [
-    {
-      "id": "RPF-WP-ADHOC-2026-08-23",
-      "from": "workplans/ADHOC-2026-08-23.md",
-      "to": "workplans/archived/260905-ADHOC-2026-08-23.md"
-    },
-    {
-      "id": "RPF-WP-0001",
-      "from": "workplans/RPF-WP-0001-credential-request-and-lease-broker.md",
-      "to": "workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md"
-    },
-    {
-      "id": "RPF-WP-0002",
-      "from": "workplans/RPF-WP-0002-openbao-approved-automation-delegation.md",
-      "to": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md"
-    },
-    {
-      "id": "RPF-WP-0003",
-      "from": "workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
-      "to": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md"
-    },
-    {
-      "id": "RPF-WP-0004",
-      "from": "workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
-      "to": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md"
-    },
-    {
-      "id": "RPF-WP-0005",
-      "from": "workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md",
-      "to": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md"
-    },
-    {
-      "id": "RPF-WP-0006",
-      "from": "workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md",
-      "to": "workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md"
-    },
-    {
-      "id": "RPF-WP-0007",
-      "from": "workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md",
-      "to": "workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md"
-    },
-    {
-      "id": "RPF-WP-0008",
-      "from": "workplans/RPF-WP-0008-credential-change-suite-stabilization.md",
-      "to": "workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md"
-    },
-    {
-      "id": "RPF-WP-0009",
-      "from": "workplans/RPF-WP-0009-platform-rapp-consistency.md",
-      "to": "workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md"
-    },
-    {
-      "id": "RPF-WP-0010",
-      "from": "workplans/RPF-WP-0010-apps-pg-resource-evidence.md",
-      "to": "workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md"
-    },
-    {
-      "id": "RPF-WP-0011",
-      "from": "workplans/RPF-WP-0011-architecture-cleanup-backlog.md",
-      "to": "workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md"
-    },
-    {
-      "id": "RPF-WP-0012",
-      "from": "workplans/RPF-WP-0012-consumption-mode-enforcement.md",
-      "to": "workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md"
-    },
-    {
-      "id": "RPF-WP-0013",
-      "from": "workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md",
-      "to": "workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md"
-    },
-    {
-      "id": "RPF-WP-0014",
-      "from": "workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md",
-      "to": "workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md"
-    },
-    {
-      "id": "RPF-WP-0016",
-      "from": "workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md",
-      "to": "workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md"
-    },
-    {
-      "id": "RPF-WP-0017",
-      "from": "workplans/RPF-WP-0017-attended-login-output-containment.md",
-      "to": "workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md"
-    },
-    {
-      "id": "RPF-WP-0018",
-      "from": "workplans/RPF-WP-0018-policy-surface-alignment.md",
-      "to": "workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md"
-    },
-    {
-      "id": "RPF-WP-0019",
-      "from": "workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md",
-      "to": "workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md"
-    },
-    {
-      "id": "RPF-WP-0020",
-      "from": "workplans/RPF-WP-0020-ccr-schema-drift.md",
-      "to": "workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md"
-    },
-    {
-      "id": "RPF-WP-0026",
-      "from": "workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md",
-      "to": "workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md"
-    },
-    {
-      "id": "RPF-WP-0028",
-      "from": "workplans/RPF-WP-0028-durable-live-image-inventory.md",
-      "to": "workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md"
-    },
-    {
-      "id": "RPF-WP-0030",
-      "from": "workplans/RPF-WP-0030-core-hub-platform-onboarding.md",
-      "to": "workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md"
-    },
-    {
-      "id": "RPF-WP-0031",
-      "from": "workplans/RPF-WP-0031-workplan-identity-collision.md",
-      "to": "workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md"
-    },
-    {
-      "id": "RPF-WP-0032",
-      "from": "workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md",
-      "to": "workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md"
-    },
-    {
-      "id": "RPF-WP-0033",
-      "from": "workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md",
-      "to": "workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md"
-    },
-    {
-      "id": "RPF-WP-0034",
-      "from": "workplans/RPF-WP-0034-state-hub-preflight-signing-design.md",
-      "to": "workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md"
-    }
-  ],
-  "superseded_tasks": {
-    "RPF-WP-0032-T02": "RPF-WP-0035-T02",
-    "RPF-WP-0033-T02": "RPF-WP-0035-T03",
-    "RPF-WP-0034-T02": "RPF-WP-0035-T04"
-  }
-}
diff --git a/workplans/archived/260905-ADHOC-2026-08-23.md b/workplans/ADHOC-2026-08-23.md
similarity index 100%
rename from workplans/archived/260905-ADHOC-2026-08-23.md
rename to workplans/ADHOC-2026-08-23.md
diff --git a/workplans/README.md b/workplans/README.md
deleted file mode 100644
index ddf39f9..0000000
--- a/workplans/README.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Current platform work
-
-Reviewed 2026-09-05. Six open workplans: five blocked on explicit owner/live
-gates and one ready for local work. Completed designs and implementations are
-under `archived/`; their IDs and UUIDs are preserved. The number of blocked
-plans is not a count of missing implementations or independent incidents.
-
-| Workplan | Purpose and next gate | S3 boundary |
-| --- | --- | --- |
-| [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
-| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup credential exposure; attended provider invalidation and replacement recovery receipts | S3 retains custody acceptance; S1 and forge own their backup execution. |
-| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
-| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; fresh synthetic-load/outage approvals and custody readiness | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
-| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | One implementation queue for secrets-engine JWT, Fluid operator KV and preflight signing | Three independent task gates; no new approval inherited from the completed designs. |
-| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | **Ready:** service guarantees, recurring evidence, S3 emission, admission consistency, ownership handoff and demand review | Local design/checking can progress while live work waits. |
-
-Start with RPF-WP-0036-T02/T05 for work that does not require a live credential
-or outage. Treat credential exposure closure as the highest-priority attended
-work; task order does not combine or waive approvals.
-
-[Assessment and disposition of every plan](../history/2026-09-05-platform-intent-workplan-assessment.md)
-and [generated current record index](../WORK-RECORDS.md).
-
-Do not recreate completed workplans because an old Hub alias or generated brief
-still shows them active. Use source IDs, and follow AGENTS.md for verified sync.
diff --git a/workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md b/workplans/RPF-WP-0001-credential-request-and-lease-broker.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md
rename to workplans/RPF-WP-0001-credential-request-and-lease-broker.md
diff --git a/workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md b/workplans/RPF-WP-0002-openbao-approved-automation-delegation.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md
rename to workplans/RPF-WP-0002-openbao-approved-automation-delegation.md
diff --git a/workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md b/workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md
rename to workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md
diff --git a/workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md b/workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md
rename to workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md
diff --git a/workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md b/workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md
rename to workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md
diff --git a/workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md b/workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md
rename to workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md
diff --git a/workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md b/workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md
rename to workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md
diff --git a/workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md b/workplans/RPF-WP-0008-credential-change-suite-stabilization.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md
rename to workplans/RPF-WP-0008-credential-change-suite-stabilization.md
diff --git a/workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md b/workplans/RPF-WP-0009-platform-rapp-consistency.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md
rename to workplans/RPF-WP-0009-platform-rapp-consistency.md
diff --git a/workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md b/workplans/RPF-WP-0010-apps-pg-resource-evidence.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md
rename to workplans/RPF-WP-0010-apps-pg-resource-evidence.md
diff --git a/workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md b/workplans/RPF-WP-0011-architecture-cleanup-backlog.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md
rename to workplans/RPF-WP-0011-architecture-cleanup-backlog.md
diff --git a/workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md b/workplans/RPF-WP-0012-consumption-mode-enforcement.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md
rename to workplans/RPF-WP-0012-consumption-mode-enforcement.md
diff --git a/workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md b/workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md
rename to workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md
diff --git a/workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md b/workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md
rename to workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md
diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
index 94476cf..da961bb 100644
--- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Coordinate audit-core temporary custody and recovery exercises"
 domain: financials
 repo: railiance-platform
-status: blocked
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-22"
-updated: "2026-09-05"
+updated: "2026-08-22"
 related:
   - AUDIT-WP-0008
   - WH-ENG-20260822-AUDIT-E2-01
@@ -119,7 +119,7 @@ copied for another engagement.
 
 ```task
 id: RPF-WP-0015-T02
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "fda4262a-56f6-5f06-a070-8fe7e1297209"
 ```
@@ -175,7 +175,7 @@ live window after the Whitehat engagement cleanup.
 
 ```task
 id: RPF-WP-0015-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "ba729d18-f053-539f-86ef-5cb8ad4cce45"
 ```
@@ -313,26 +313,3 @@ each task.
 - [ ] Database recovery is restart-free and evidenced without credential values.
 - [ ] Reboot recovery has an ordered, owner-signed checklist and abort path.
 - [x] No live action is implied by completing this design workplan.
-
-## Portfolio review — 2026-09-05
-
-INTENT binding: tested recovery and dependable custody. Procedure construction
-is complete; the two tasks were incorrectly left `progress` while their live
-windows remained unavailable. They now explicitly wait. This does not claim
-that the experiments passed or that prior expired approvals can be reused.
-
-T02 retains the S3 lease/ESO acceptance contribution. `audit-core` owns the
-synthetic-load driver and application retry/readiness proof (AUDIT-WP-0008);
-`rapp-postgres` owns database acceptance. Unblock with a revision-pinned load
-receipt, named abort operator and fresh bounded window.
-
-T03 retains only S3 snapshot, quorum/unseal, ESO and database-readiness gates.
-Host reboot execution belongs to `railiance-infra`, cluster recovery to
-`railiance-cluster`, application acceptance to audit-core. Existing owner
-procedure receipts remain evidence of review, not fresh live GO. Unblock with
-fresh snapshot/quorum/access evidence, owner confirmations and an outage window.
-The terminal NO-GO is not rerunnable. RPF-WP-0017 closed the local output
-containment defect; the next attempt still needs current acceptance evidence.
-
-Do not create another platform-owned whole-host drill or duplicate these live
-tasks in RPF-WP-0036; that plan owns recurring service assurance.
diff --git a/workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md b/workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md
rename to workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md
diff --git a/workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md b/workplans/RPF-WP-0017-attended-login-output-containment.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md
rename to workplans/RPF-WP-0017-attended-login-output-containment.md
diff --git a/workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md b/workplans/RPF-WP-0018-policy-surface-alignment.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md
rename to workplans/RPF-WP-0018-policy-surface-alignment.md
diff --git a/workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md b/workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md
rename to workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md
diff --git a/workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md b/workplans/RPF-WP-0020-ccr-schema-drift.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md
rename to workplans/RPF-WP-0020-ccr-schema-drift.md
diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
index c67f5ed..67cbe2d 100644
--- a/workplans/RPF-WP-0025-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-05"
+updated: "2026-08-23"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
@@ -85,14 +85,3 @@ is ready to complete the browser/MFA act.
 
 This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
 Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.
-
-## Portfolio review — 2026-09-05
-
-INTENT binding: secure custody and an operable operator access path. Retain
-T03 as the one attended cutover task; do not merge its approval/window with
-incident rotation or reboot. Platform owns the exact OpenBao callback and
-custody acceptance; rapp-openbao owns package exposure, KeyCape/NetKingdom the
-issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives.
-Unblock with a fresh attended OIDC/MFA callback update and loopback login,
-then the guarded retraction and owner-specific DNS handoff. Existing source
-readiness is not evidence of a completed live cutover.
diff --git a/workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md b/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md
rename to workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
diff --git a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
index c6efab8..4303b3f 100644
--- a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
+++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Coordinate KeyCape live Secret exposure recovery"
 domain: financials
 repo: railiance-platform
-status: blocked
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-05"
+updated: "2026-08-23"
 related:
   - KEY-WP-0011
 origin: routed
@@ -56,7 +56,7 @@ predecessor revocation, and sanitized evidence.
 
 ```task
 id: RPF-WP-0027-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1"
 ```
@@ -96,7 +96,7 @@ lane remains unresolved and no credential fetch or retry is authorized.
 
 ```task
 id: RPF-WP-0027-T04
-status: done
+status: wait
 priority: high
 state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7"
 ```
@@ -123,7 +123,7 @@ status, timestamps, and cleanup receipts.
 
 ```task
 id: RPF-WP-0027-T06
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
 ```
@@ -135,34 +135,3 @@ attended handoff identifier. Do not infer or invent any of these values. After
 publication, update `docs/net-kingdom-credential-custody-contract.md`, ask
 ops-warden to refresh lane resolvability, and pass only protected inputs to
 NetKingdom's minimal resolver reconciliation flow.
-
-## Portfolio review — 2026-09-05
-
-INTENT binding: secure custody and incident closure. The goal above is historical;
-the remaining platform scope is custody and acceptance of owner evidence.
-
-**T04 is complete by existing owner evidence, not by a new action here.**
-`key-cape/workplans/KEY-WP-0011-live-secret-exposure-recovery.md` T02/T03 and
-`net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md` T04
-record the approved 2026-08-23 bundle replacement. Do not repeat that rotation
-merely because this platform task previously remained `wait`.
-
-The 2026-08-27 NK-WP-0033-T05 update is newer than the earlier notes above:
-the resolver binding was reconciled, but there is no complete green receipt.
-The predecessor value is unavailable; manual observations are not a recorded
-negative proof. No one should recover or fabricate a predecessor just to make
-a test pass. The incident owner must rule explicitly on the residual evidence
-and acceptable disposition. Overall incident closure remains open.
-
-- T03 waits for current NetKingdom/provider evidence disposition and the exact
-  platform custody acknowledgements; old procedure acknowledgements exist.
-- T05 waits for the repaired owner command's sanitized receipt and the
-  incident owner's explicit disposition of the unavailable predecessor.
-  NetKingdom owns resolver/MFA execution (NK-WP-0033-T03/T05); this repo accepts
-  custody-related results without taking over the identity provider.
-- T06 waits for confirmed mount/path/fields, writer/reader authority and the
-  operator handoff. The existing draft leaves those facts intentionally blank.
-
-No new owner acceptance or coordination message is asserted by this review.
-Keep this incident separate from the new-lane queue; broad lane approval cannot
-close an exposure.
diff --git a/workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md b/workplans/RPF-WP-0028-durable-live-image-inventory.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md
rename to workplans/RPF-WP-0028-durable-live-image-inventory.md
diff --git a/workplans/RPF-WP-0029-backup-credential-default-removal.md b/workplans/RPF-WP-0029-backup-credential-default-removal.md
index e977055..97beaa5 100644
--- a/workplans/RPF-WP-0029-backup-credential-default-removal.md
+++ b/workplans/RPF-WP-0029-backup-credential-default-removal.md
@@ -37,13 +37,3 @@ state_hub_task_id: "b3f3402f-890b-5781-9b3e-1c9c0d28cea8"
 ```
 
 Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape.
-
-## Portfolio review — 2026-09-05
-
-INTENT binding: dependable backup custody and recovery. Retain T02 until the
-provider owner invalidates the predecessor and supplies replacement upload and
-restore receipts through CCR-2026-0004. Source removal is already complete.
-S1 backup scheduling belongs to RAIL-HO-WP-0012; forge backup orchestration and
-artifact retention belong to railiance-forge. RPF-WP-0036-T06 will obtain an
-accepted compatibility handoff, but this exposure obligation stays visible
-here until its evidence is accepted. No rotation was executed in this review.
diff --git a/workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md b/workplans/RPF-WP-0030-core-hub-platform-onboarding.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md
rename to workplans/RPF-WP-0030-core-hub-platform-onboarding.md
diff --git a/workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md b/workplans/RPF-WP-0031-workplan-identity-collision.md
similarity index 100%
rename from workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md
rename to workplans/RPF-WP-0031-workplan-identity-collision.md
diff --git a/workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md b/workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md
similarity index 76%
rename from workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md
rename to workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md
index a5e1c61..f9ffbfa 100644
--- a/workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md
+++ b/workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Design secrets-engine service JWT login"
 domain: financials
 repo: railiance-platform
-status: finished
+status: blocked
 owner: codex
 created: "2026-09-05"
 updated: "2026-09-05"
@@ -32,7 +32,7 @@ production objects changed or owner messages sent.
 
 ```task
 id: RPF-WP-0032-T02
-status: cancel
+status: wait
 priority: high
 state_hub_task_id: "d1f4a9f6-4ea5-5daa-97bb-039856855bc2"
 ```
@@ -41,11 +41,3 @@ Confirm issuer, verification endpoint, actual KeyCape registration and live auth
 
 Review the linked design and pin current source revisions before implementation.
 Do not interpret this workplan or a proposed coordinate as live authorization.
-
-## Portfolio review — 2026-09-05
-
-The design deliverable is complete. The implementation obligation is preserved
-in **RPF-WP-0035-T02**, the single credential-lane implementation queue.
-T02 is `cancel` here only because it is superseded there; it is not implemented,
-waived or externally accepted. The approved design scope and all existing
-identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.
diff --git a/workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md b/workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md
similarity index 76%
rename from workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md
rename to workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md
index 8fa4fac..d8e85bb 100644
--- a/workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md
+++ b/workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Design fluid-telegram attended operator KV lane"
 domain: financials
 repo: railiance-platform
-status: finished
+status: blocked
 owner: codex
 created: "2026-09-05"
 updated: "2026-09-05"
@@ -32,7 +32,7 @@ production objects changed or owner messages sent.
 
 ```task
 id: RPF-WP-0033-T02
-status: cancel
+status: wait
 priority: high
 state_hub_task_id: "a542697f-adf8-59ac-9704-0bcde1d9fd0f"
 ```
@@ -41,11 +41,3 @@ Obtain tenant/group/MFA decisions; extend the CCR schema, validator, renderer an
 
 Review the linked design and pin current source revisions before implementation.
 Do not interpret this workplan or a proposed coordinate as live authorization.
-
-## Portfolio review — 2026-09-05
-
-The design deliverable is complete. The implementation obligation is preserved
-in **RPF-WP-0035-T03**, the single credential-lane implementation queue.
-T02 is `cancel` here only because it is superseded there; it is not implemented,
-waived or externally accepted. The approved design scope and all existing
-identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.
diff --git a/workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md b/workplans/RPF-WP-0034-state-hub-preflight-signing-design.md
similarity index 76%
rename from workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md
rename to workplans/RPF-WP-0034-state-hub-preflight-signing-design.md
index 75151de..74f3d73 100644
--- a/workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md
+++ b/workplans/RPF-WP-0034-state-hub-preflight-signing-design.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Design State Hub preflight signing custody"
 domain: financials
 repo: railiance-platform
-status: finished
+status: blocked
 owner: codex
 created: "2026-09-05"
 updated: "2026-09-05"
@@ -32,7 +32,7 @@ production objects changed or owner messages sent.
 
 ```task
 id: RPF-WP-0034-T02
-status: cancel
+status: wait
 priority: high
 state_hub_task_id: "96e4864a-fd17-529b-a72f-69ffd885a962"
 ```
@@ -41,11 +41,3 @@ Confirm exact primary deployment and delivery identity; approve the writer and r
 
 Review the linked design and pin current source revisions before implementation.
 Do not interpret this workplan or a proposed coordinate as live authorization.
-
-## Portfolio review — 2026-09-05
-
-The design deliverable is complete. The implementation obligation is preserved
-in **RPF-WP-0035-T04**, the single credential-lane implementation queue.
-T02 is `cancel` here only because it is superseded there; it is not implemented,
-waived or externally accepted. The approved design scope and all existing
-identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.
diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md
deleted file mode 100644
index 906f366..0000000
--- a/workplans/RPF-WP-0035-credential-lane-implementation.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-id: RPF-WP-0035
-type: workplan
-title: "Implement reviewed credential lanes with separate owner gates"
-domain: financials
-repo: railiance-platform
-status: blocked
-owner: codex
-created: "2026-09-05"
-updated: "2026-09-05"
-related:
-  - RPF-WP-0032
-  - RPF-WP-0033
-  - RPF-WP-0034
-state_hub_workstream_id: "975db491-5412-5e27-8e34-14a2417bb039"
----
-
-# Credential lane implementation
-
-One S3 queue for three designed lanes; each task keeps its own approval,
-execution and closure boundary. This replaces the implementation tasks in the
-three completed design workplans, not the designs themselves. No approval is
-inherited by consolidation. INTENT binding: secure custody, dependable delivery,
-stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029.
-
-## Consolidate completed designs and owner dependencies
-
-```task
-id: RPF-WP-0035-T01
-status: done
-priority: medium
-state_hub_task_id: "0f3606bb-e95b-5484-8a57-bcdd6e3916fd"
-```
-
-Completed 2026-09-05. Preserved the three designs under
-`docs/credential-lane-designs/`, identified native owner responsibilities and
-linked each superseded task below. Owners have not been sent new requests and
-no new external acceptance is claimed. STATE-WP-0085-T09 is already done;
-the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
-
-## Accept and provision secrets-engine service JWT login
-
-```task
-id: RPF-WP-0035-T02
-status: wait
-priority: high
-state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
-```
-
-Supersedes RPF-WP-0032-T02. Design:
-`docs/credential-lane-designs/secrets-engine-service-jwt.md`.
-
-Platform owns the exact JWT mount/role/policy, effective-policy negative tests
-and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service
-registration (KEY-WP-0009); secrets-engine owns service authentication and
-authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
-
-**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer
-readiness, approved source and attended apply authority. A service login does
-not grant lane mutation authority. Do not build another identity provider or
-lifecycle engine here.
-
-**Done when:** approved exact role succeeds for the intended service, wrong
-issuer/audience/subject/claims and unrelated secret access fail, bounded TTL
-and revocation are proven, the consumer explicitly opts into the verified
-contract, and rollback/cleanup receipts contain no secret material.
-
-## Implement the platform operator-write CCR contract and Fluid lane
-
-```task
-id: RPF-WP-0035-T03
-status: wait
-priority: high
-state_hub_task_id: "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
-```
-
-Supersedes RPF-WP-0033-T02. Design:
-`docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
-
-Platform owns the per-path capability schema/validator, exact OpenBao policy
-and accepted custody coordinates. MASON-WP-0005 owns construction coordination
-and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership;
-FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram
-application acceptance. Retain the existing read-only CCR semantics.
-
-**Unblock:** accept tenant/path and per-entry field/capability matrix; confirm
-actual group/assurance and callbacks, reviewed construction contract and writer
-authority. Contract review can proceed without a live credential; the final
-schema cannot be treated as accepted solely because a draft exists.
-
-**Done when:** validation rejects broad/unsupported grants, the consumer proves
-CAS=0 first-write behavior and no value output, approved identities can perform
-only the exact matrix, negative/expiry/revocation checks pass, custody is seeded
-through the separate writer, and the verified route has a safe handoff receipt.
-The unattended adapter remains a separate demand and gets no operator session.
-
-## Accept the needed signing lane and deliver it to the owning runtime
-
-```task
-id: RPF-WP-0035-T04
-status: wait
-priority: medium
-state_hub_task_id: "35a85846-61d5-54ce-8b18-ede45733d53c"
-```
-
-Supersedes RPF-WP-0034-T02. Design:
-`docs/credential-lane-designs/state-hub-preflight-signing.md`.
-
-Platform owns signing-key custody, exact read policy/role and scoped delivery
-acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing
-and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency;
-STATE-WP-0085-T09's adoption-plan delivery is already complete.
-
-**Unblock:** State Hub/repo-manager and the consuming migration owner confirm
-that this transitional State Hub lane is still needed during retirement;
-record the target runtime, namespace/SA/auth audience and an executable
-rotation fence, plus approved writer and deployment window. Do not broaden the
-lane into a general repository-rename authority or provision for a stale demand.
-
-**Done when:** protected one-time generation, API-only ESO delivery, negative
-access checks and a non-mutating signed preflight pass; every API replica uses
-the accepted version; rotation/invalidation and recovery are evidenced. No
-repository rename is part of S3 lane acceptance. If demand is withdrawn, record
-the owning decision and cancel this task explicitly rather than provision it.
diff --git a/workplans/RPF-WP-0036-platform-service-assurance.md b/workplans/RPF-WP-0036-platform-service-assurance.md
deleted file mode 100644
index 9e0a246..0000000
--- a/workplans/RPF-WP-0036-platform-service-assurance.md
+++ /dev/null
@@ -1,173 +0,0 @@
----
-id: RPF-WP-0036
-type: workplan
-title: "Close S3 service assurance and ownership gaps"
-domain: financials
-repo: railiance-platform
-status: ready
-owner: codex
-created: "2026-09-05"
-updated: "2026-09-05"
-state_hub_workstream_id: "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84"
----
-
-# S3 service assurance and ownership gaps
-
-Source: `history/2026-09-05-platform-intent-workplan-assessment.md`.
-Reviewed against current repository evidence. This plan supplies the missing
-continuing obligations; it does not reopen completed bootstrap projects or
-duplicate incident/lane work. Repository design and read-only implementation
-can progress now. Every live drill, scheduler, credential operation or migration
-retains its own owner and execution gate.
-
-## Record the portfolio assessment and consolidate source work
-
-```task
-id: RPF-WP-0036-T01
-status: done
-priority: high
-state_hub_task_id: "9c6d0439-8a14-5921-9d88-95a10b303057"
-```
-
-Completed 2026-09-05. Assessed all 37 existing plans and their 168 task records,
-corrected SCOPE, grouped the remaining obligations, consolidated the three
-design follow-ups under RPF-WP-0035, archived completed plans with identities
-preserved, and recorded owner handoffs and before/after inventory in history.
-This certifies the source review, not live service health or external acceptance.
-
-## Publish achievable service guarantees and recovery ownership
-
-```task
-id: RPF-WP-0036-T02
-status: todo
-priority: high
-state_hub_task_id: "eebcd5c7-4cfd-5084-9a21-ca1e4e748bdd"
-```
-
-For apps-pg, platform-pg, OpenBao and each supported backup delivery lane,
-publish a versioned service record: accountable S3/package/operator owners,
-consumers, failure domain, availability objective, RPO/RTO, retention, recovery
-key/quorum availability, maintenance/abort path and evidence freshness budget.
-Separate measured results from accepted targets and unknowns. A 56-second
-scratch restore is not an RTO commitment; one replica on one host is not HA.
-Reuse `docs/s3-consumer-interfaces.md` and existing package declarations.
-
-**Done when:** every supported service has owner-reviewed numeric targets or
-an explicit unsupported guarantee and decision owner; consumer requirements
-are compared to the current substrate; any HA/node-loss gap has an exact S1/S2
-and package dependency rather than a blanket new-cluster project here.
-
-## Make backup freshness and recurring recovery evidence checkable
-
-```task
-id: RPF-WP-0036-T03
-status: todo
-priority: high
-state_hub_task_id: "d64446fb-870b-5ae9-9628-f1fb9d06c5a4"
-```
-
-Inventory authoritative CNPG backup/PITR, OpenBao snapshot/isolated restore,
-encrypted off-host copy and custody-recovery receipts. Reuse existing validators
-and package status commands. Define cadence/expiry from T02; return distinct
-healthy, stale, missing and unavailable states using metadata only. Schedule
-execution only through the accepted execution owner and separately approved
-authority. Keep RPF-WP-0015's pending database/reboot experiments as the sole
-live tasks for those experiments; RPF-WP-0029 retains provider-key recovery.
-
-**Done when:** a current off-host backup and a current isolated restore receipt
-exist for each supported data service, the approved cadence is installed and
-its execution is evidenced, and missing/stale/failed evidence reaches a named
-operator. A template, dated successful snapshot, or same-PVC reboot does not
-pass as restore proof. Record independent recovery-key access without values.
-
-## Produce S3 signals and prove their delivery to the evidence owner
-
-```task
-id: RPF-WP-0036-T04
-status: todo
-priority: high
-state_hub_task_id: "5351e0e4-6263-58f0-afb2-7c78c4cd6f68"
-```
-
-Define service-owned health semantics for backup/WAL age, restore age, seal
-state, ESO freshness, connection/memory headroom and consumer ceiling. Reuse
-package emitters and the Q2 owner's standard contract; retain an explicit
-unmonitored state and named manual checker until transport is accepted.
-Request a concrete receiving contract from railiance-telemetry when routing is
-authorized; do not implement a competing monitoring plane in S3.
-
-**Done when:** bounded metadata-only samples pass contract validation, a
-controlled stale/failure sample reaches a named recipient through the accepted
-Q2 route, and missing emission itself is detectable. Local fixture tests may
-finish before the receiver, but end-to-end acceptance cannot.
-
-## Reconcile admission, placement and consumer interface drift
-
-```task
-id: RPF-WP-0036-T05
-status: todo
-priority: high
-state_hub_task_id: "5cded2e9-7edd-57bd-9f7e-7977b75004dc"
-```
-
-Join actual package declarations and authorized metadata to the S3 interface,
-tenancy and placement records. Correct stale platform-pg occupancy/co-residency
-(Core Hub admission versus older tenant-engine descriptions), distinguish
-desired placement from observed placement, and verify the named overflow
-targets remain provisionable. Add a bounded check for missing owners,
-unsupported retention requests, quota/ceiling drift and stale evidence; consume
-package admission checks instead of reimplementing them.
-
-**Done when:** every admitted consumer has one authoritative placement/contract,
-capacity and retention disclosures match package source and dated live proof,
-and synthetic invalid admissions fail before provisioning. No workload moves
-under this task without its own owner-reviewed migration.
-
-## Obtain acceptance for compatibility assets and derived-record cleanup
-
-```task
-id: RPF-WP-0036-T06
-status: todo
-priority: medium
-state_hub_task_id: "3b74f79c-7366-5d00-bf0e-31c0464a8f33"
-```
-
-Prepare exact source/entry-point inventories and owner-ready handoffs for
-Forgejo backup/pruning/image inventory (`railiance-forge`, activity-core
-execution), retained OpenBao package wrappers (`rapp-openbao`), and ArgoCD
-bootstrap/application manifests (S2/S4/S5 according to artifact). Keep S3
-custody contracts and the RPF-WP-0029 exposure obligation here until accepted
-closure. No new framework or app-specific helper belongs here by default.
-
-Supply repo-manager/State Hub with the exact legacy alias/source identity map
-from the assessment. Their apparent duplicate active records and stale brief
-are derived-state defects, not additional workplans. Use scoped reconciliation;
-never change managed UUIDs or blanket-acknowledge retirements to clean a view.
-
-**Done when:** each retained compatibility surface has an accepting owner,
-canonical replacement and tested callers or a dated retention decision; the
-repo-filtered projection and generated brief agree with source identities.
-Unaccepted transfer remains explicitly pending. No requests were sent during
-the assessment and this task does not assert acceptance for another repo.
-
-## Decide demand and reuse for undeployed stateful capabilities
-
-```task
-id: RPF-WP-0036-T07
-status: todo
-priority: medium
-state_hub_task_id: "b32709d2-581d-5750-a04c-e3494a42d27e"
-```
-
-Review cache, general object storage and messaging separately with potential
-consumers. Inventory existing providers/contracts (including artifact-store
-and the external backup bucket) before selecting an engine. Record workload,
-durability/latency/retention needs, capacity, tenancy, custody, package owner,
-recovery cost and operating owner for any accepted demand. Ask railiance-master
-to resolve fleet Q3 ownership through its architecture process; do not assign
-it to S3 by implication.
-
-**Done when:** each capability has a dated decision to reuse, defer with a
-review trigger, or start a bounded consumer-backed delivery plan with explicit
-acceptance criteria. “No accepted demand; keep deploy gated” is a valid result.
-No Valkey, MinIO, RabbitMQ or new provider purchase is authorized by this plan.