diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
index 27013ae..6f9b496 100644
--- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
+++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
@@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04.
 
 ```task
 id: RESOURCE-WP-0002-T04
-status: done
+status: progress
 priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```
@@ -254,22 +254,16 @@ instructions, handle `secret:railiance-platform/backup`, first consumer
 projection Secret `platform-pg-backup-s3`. Non-secret destination
 handed at
 `rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
-2026-08-14: founder approved CCR-2026-0012 and put the backup key in
-OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1).
-Positive S3 list/get and prefix put/get/delete succeeded. Negative:
-bogus secret denied; IAM/billing/k8s list denied. Distinct from the
-bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage`
-and AppRole `external-secrets-backup-object-storage` applied.
-ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret
-synced Secret `databases/platform-pg-backup-s3` (keys present, values
-not read). Prefix `platform-pg/` is empty (0 objects). Cluster still
-has no `barmanObjectStore`. WAL remains T05.
+Waiting on founder: approve the CCR, use IAM application
+`resource-control`, bind policy and key `Scoped backup access`, put
+values in OpenBao, say “the backup key is in bao.” Do not enable WAL
+yet.
 
 ## T05 — Prove backup, full restore, and PITR
 
 ```task
 id: RESOURCE-WP-0002-T05
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
 ```