diff --git a/SCOPE.md b/SCOPE.md
index 425c42a..80f2648 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -27,16 +27,15 @@ Railiance, without moving product ownership into an operations repository.
 
 ## Current State
 
-**Draft.** The package is written and its manifests parse, but nothing is
-deployed and `readiness_state` is `draft`. Two things block a first rollout,
-both operator actions rather than authoring ones:
+**Declared.** The image is published and pinned by digest
+(`sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123`), the manifests parse, and
+`readiness_state` is `declared`. Nothing is deployed yet.
 
-- the image has never been published, so no registry digest exists to pin
-  (`declarations/rapp.yaml` says `pending-publication` rather than carrying a
-  placeholder that could be mistaken for something deployable);
-- database roles and OpenBao credentials are not provisioned.
+One thing blocks a first rollout: the database and its roles do not exist.
+`rapp-postgres` has the request as `consumers/canned-prompts.yaml`; minting the
+OpenBao credentials is its operator's step, not this repo's.
 
-`workplans/RCP-WP-0002-first-deployment.md` carries both.
+`workplans/RCP-WP-0002-first-deployment.md` carries the remaining sequence.
 
 ## Verification
 
diff --git a/declarations/rapp.yaml b/declarations/rapp.yaml
index 9153f7a..2c7433a 100644
--- a/declarations/rapp.yaml
+++ b/declarations/rapp.yaml
@@ -4,7 +4,7 @@ rapp_id: rapp-canned-prompts
 repo: rapp-canned-prompts
 ownership_repo: canned-prompts
 contract_version: 1.0.0
-readiness_state: draft
+readiness_state: declared
 workload_identity:
   name: canned-prompts
   package_type: manifest-managed-platform-service
@@ -34,12 +34,11 @@ composition:
   upstream_components:
     - name: canned-prompts
       source: forgejo.coulomb.social/coulomb/canned-prompts
-      # NOT YET PUBLISHED. The image builds and was verified locally
-      # (CANP-WP-0006-T06), but has never been pushed, so no registry digest
-      # exists to pin. A placeholder shaped like a digest would be worse than
-      # this sentinel: it could be mistaken for something deployable.
-      # RCP-WP-0001-T01 replaces this with the real digest.
-      version: pending-publication
+      # Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.0.
+      # Pinned by digest rather than tag: a tag can be moved, and
+      # live-image-digest-match would then pass against something that is no
+      # longer what this repo reviewed.
+      version: sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
 rollout_contract:
   default_mode: kubectl-server-side-apply
 smoke_contract:
diff --git a/manifests/migration.yaml b/manifests/migration.yaml
index 8b771db..846df10 100644
--- a/manifests/migration.yaml
+++ b/manifests/migration.yaml
@@ -29,8 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          # REPLACE on first publication — see declarations/rapp.yaml.
-          image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication
+          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
           command: ["alembic"]
           args: ["upgrade", "head"]
           workingDir: /app
diff --git a/manifests/runtime.yaml b/manifests/runtime.yaml
index 83b8bf9..3bb3ab9 100644
--- a/manifests/runtime.yaml
+++ b/manifests/runtime.yaml
@@ -27,8 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: canned-prompts
-          # REPLACE on first publication — see declarations/rapp.yaml.
-          image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication
+          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/workplans/RCP-WP-0002-first-deployment.md b/workplans/RCP-WP-0002-first-deployment.md
index 1917c8b..c4c2b58 100644
--- a/workplans/RCP-WP-0002-first-deployment.md
+++ b/workplans/RCP-WP-0002-first-deployment.md
@@ -4,7 +4,7 @@ type: workplan
 title: "First deployment of canned-prompts on Railiance"
 domain: agents
 repo: rapp-canned-prompts
-status: proposed
+status: active
 owner: codex
 topic_slug: practice
 created: "2026-09-06"
@@ -25,7 +25,7 @@ it deployed.
 
 ```task
 id: RCP-WP-0002-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3e7faf50-8fe9-5ef3-8a75-1d9e586d6c0f"
 ```
@@ -41,17 +41,28 @@ The image builds and was verified locally in `canned-prompts`
 pass against the running container, and the reference CLI installs a package
 from it over HTTP.
 
-What remains is publication to `forgejo.coulomb.social/coulomb/canned-prompts`,
-which needs registry credentials. Then replace `pending-publication` in
-`declarations/rapp.yaml`, `manifests/runtime.yaml` and `manifests/migration.yaml`
-with the `@sha256:` digest — the same digest in all three, since
-`live-image-digest-match` compares them.
+**Done, 2026-09-07.** Published as
+`forgejo.coulomb.social/coulomb/canned-prompts:0.1.0` and pinned by **digest**
+in the declaration and both manifests:
+
+```
+sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
+```
+
+Pinned by digest rather than tag deliberately: a tag can be moved, and
+`live-image-digest-match` would then pass against something that is no longer
+what this repo reviewed.
+
+Verified before pushing — the image resolves a file-mounted credential, carries
+the reference validator, and ships the migration scripts — and verified after,
+by fetching the manifest back **by digest** rather than trusting the push
+output. `readiness_state` moved `draft` → `declared`.
 
 ## Provision database roles and credentials
 
 ```task
 id: RCP-WP-0002-T02
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "61f5cbd7-8fcf-5156-87da-57239ae55d8f"
 ```
@@ -71,17 +82,33 @@ Needed from `rapp-postgres` and the credential broker:
 read-only, which is the correct posture until per-publisher identity exists —
 not a misconfiguration to be worked around.
 
+**Requested, 2026-09-07.** `rapp-postgres` now carries
+`consumers/canned-prompts.yaml`, authored against its documented
+`PostgresConsumer` shape, and its agent has the request in its inbox.
+
+The declaration only. `make provision-consumers` — the step that actually mints
+OpenBao credentials — was deliberately **not** run: credential issuance is
+`rapp-postgres`' to perform, and running it from the consuming side would take a
+decision that is not this repo's, however available the script happens to be.
+
+Blocked here until those credentials exist. T03 and T04 are blocked behind it.
+
 ## Apply and migrate
 
 ```task
 id: RCP-WP-0002-T03
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "0b8d206e-bd28-5950-abf7-d824015c09a4"
 ```
 
 Order matters, and the ordering is the point rather than a convenience:
 
+Verified against the live cluster before writing: `platform-pg-2` exists and is
+healthy, and the `railiance.io/postgres-client: platform-pg-2` label matches
+what `sbom-nexus` actually carries in the cluster rather than only what its repo
+says.
+
 1. `manifests/00-namespace.yaml` — the `railiance.io/postgres-client` label is
    what lets the database namespace accept traffic;
 2. `manifests/database-secrets.yaml`, then wait for the secrets to materialize;
@@ -97,7 +124,7 @@ other.
 
 ```task
 id: RCP-WP-0002-T04
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "6d9eb97c-57e2-5b74-b6eb-455076713417"
 ```