From 0f44fbeea18147e65f379632621f2f29ded5f310 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 21 Oct 2026 00:56:29 +0200 Subject: [PATCH] chore(workplans): record founder approval in principle for WP14/WP15 T04 gates Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 809600@bnt-lap001 Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4 --- ...RETS-WP-0014-pdp-transport-and-responder-authentication.md | 4 ++++ .../SECRETS-WP-0015-original-keycape-recovery-selector.md | 2 ++ 2 files changed, 6 insertions(+) diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md index 4c5ba93..9728726 100644 --- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md @@ -130,6 +130,10 @@ signs it in namespace `secrets-engine-pdp-trust`. Record only the principal, key fingerprint and trust-file hash. This is founder action, not worker work. A local signature test is not admission. +2026-10-21: decision e4eee965 resolved by the founder as approved in principle. +The approach is accepted. The remaining gate is the founder's actual signature over +the real trust file once FLEX-WP-0024-T06 delivers the key. + ## Verify the admitted native consumer and rotation path ```task diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md index 658bda0..f08d281 100644 --- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md +++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md @@ -142,6 +142,8 @@ state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73" Before any key prompt, the selector preflight must pass with `--admission` on the founder-signed attempt document for this exact case (T05). +2026-10-21: decision d1ab097d resolved by the founder as approved in principle. +The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready. Only a separately admitted owner action can establish actual archived registration, issuer trust, native negative checks and consumer continuity. Source selector and historical provider proof do not fill this gate. No production consumer redirect,