diff --git a/docs/evidence/2026-10-21-service-jwt-boundary.json b/docs/evidence/2026-10-21-service-jwt-boundary.json
new file mode 100644
index 0000000..18377f9
--- /dev/null
+++ b/docs/evidence/2026-10-21-service-jwt-boundary.json
@@ -0,0 +1,49 @@
+{
+  "status": "passed",
+  "phase": "attended_boundary_verification",
+  "task": "SECRETS-WP-0008-T06",
+  "serves": "RPF-WP-0035-T02 (CCR-2026-0038 effective policy and capabilities-self denials)",
+  "observed_at": "2026-10-21",
+  "operator": "founder (attended, KeyCape OIDC login with MFA)",
+  "authorization": "founder authorized the attended boundary run in session on 2026-10-21",
+  "command": "tools/verify_service_jwt_boundary.py --ccr <railiance-platform>/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml --execute",
+  "tool_commit": "4378ec1",
+  "bao_addr": "http://127.0.0.1:18200",
+  "result": {
+    "auth_provider": "service-jwt",
+    "capability_denials": {
+      "auth/*/role/*": true,
+      "auth/token/create": true,
+      "platform/data/workloads/keycape/secrets-engine-openbao": true,
+      "platform/metadata/workloads/keycape/secrets-engine-openbao": true,
+      "sys/policies/acl/*": true
+    },
+    "ccr_sha256": "65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0",
+    "claim_negatives_proved": false,
+    "contract_sha256": "a98663c316611c4b2773f197c734befb8446e8efe20f563da018c358c3b11d77",
+    "denied_paths": [
+      "platform/data/workloads/keycape/secrets-engine-openbao",
+      "platform/metadata/workloads/keycape/secrets-engine-openbao",
+      "sys/policies/acl/*",
+      "auth/*/role/*",
+      "auth/token/create"
+    ],
+    "established": true,
+    "exact_self_policy": true,
+    "expected_policy": "secrets-engine-login-self",
+    "native_verified": true,
+    "operator_revocation_attempted": true,
+    "operator_revocation_succeeded": true,
+    "operator_session_handle": "30835a05b52b",
+    "protected_operation_adoption_proved": false,
+    "revocation_attempted": true,
+    "revocation_succeeded": true,
+    "secret_source": "openbao-oidc-in-memory",
+    "session_handle": "d8a4b397fa4d"
+  },
+  "notes": [
+    "Two service-token metadata requests (lookup-self, one batched capabilities-self), then unconditional service and operator revocation.",
+    "Output is restricted to hashes, booleans and 12-hex session fingerprints; no response bodies, tokens or values were recorded.",
+    "Not proved here: native KeyCape claim negatives (KEY-WP-0039-T02), token expiry/use exhaustion, and protected-operation adoption."
+  ]
+}
diff --git a/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md b/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
index b0d05c9..12f2fd4 100644
--- a/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
+++ b/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md
@@ -332,11 +332,19 @@ Acceptance:
 id: SECRETS-WP-0008-T06
 status: wait
 depends_on: [RPF-WP-0035-T02]
-blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
+blocking_reason: "Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 expiry/use checks (effective-policy/capability passed 2026-10-21) and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback."
 priority: medium
 state_hub_task_id: "d7bc8bdc-a0f8-5058-a640-374ef9859148"
 ```
 
+Progress 2026-10-21. The founder authorized the CCR-2026-0038 boundary check, and it
+passed attended (`docs/evidence/2026-10-21-service-jwt-boundary.json`). The self policy
+is exactly `secrets-engine-login-self` with no identity policies. capabilities-self
+denies both client-secret guard paths, `sys/policies/acl/*`, `auth/*/role/*` and
+`auth/token/create`. Service and operator revocation both succeeded. The receipt went
+to railiance-platform for RPF-WP-0035-T02. Still open: KEY-WP-0039-T02 claim negatives,
+expiry/use exhaustion, MASON-WP-0009-T05, and task-scoped execution entitlement.
+
 Progress 2026-10-10. The CCR-2026-0038 no-fallback check, which is
 secrets-engine's to prove, passed. Fixing it exposed a gap: the anonymous JWT
 login inherited `BAO_TOKEN`/`VAULT_TOKEN` and the CLI token helper, so it sent an