chore(workplans): record founder approval in principle for WP14/WP15 T04 gates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4

workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

@@ -130,6 +130,10 @@ signs it in namespace `secrets-engine-pdp-trust`. Record only the principal, key
 fingerprint and trust-file hash. This is founder action, not worker
 work. A local signature test is not admission.
 
+2026-10-21: decision e4eee965 resolved by the founder as approved in principle.
+The approach is accepted. The remaining gate is the founder's actual signature over
+the real trust file once FLEX-WP-0024-T06 delivers the key.
+
 ## Verify the admitted native consumer and rotation path
 
 ```task

workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md

@@ -142,6 +142,8 @@ state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
 
 Before any key prompt, the selector preflight must pass with `--admission` on the
 founder-signed attempt document for this exact case (T05).
+2026-10-21: decision d1ab097d resolved by the founder as approved in principle.
+The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready.
 Only a separately admitted owner action can establish actual archived registration,
 issuer trust, native negative checks and consumer continuity. Source selector and
 historical provider proof do not fill this gate. No production consumer redirect,