diff --git a/workplans/TEN-WP-0012-external-conformance-waits.md b/workplans/TEN-WP-0012-external-conformance-waits.md
index e4d0a77..69fdef0 100644
--- a/workplans/TEN-WP-0012-external-conformance-waits.md
+++ b/workplans/TEN-WP-0012-external-conformance-waits.md
@@ -125,6 +125,17 @@ externally, **or** audit-core declines and `SCOPE.md` row
 Do not: request the token by message, or synthesize a local stand-in that
 would make the outbox look drained when it is not.
 
+**2026-10-01 — token minted; manifest side done here; projection pending.**
+audit-core minted the sender token on 2026-09-15 (`AUDIT-WP-0010-T02`) and
+proved a 202/200 pair (`T05`). `deploy/base/tenant-engine.yaml` now carries the
+egress rule, the two `TENANT_ENGINE_AUDIT_CORE_*` variables and an optional
+mount for Secret `tenant-engine-audit-core-sender` (`TEN-IN-0005`, `9fabfd7`).
+What remains is outside this repo: `ops-mason` `MASON-WP-0007` (draft plan,
+blocked) for a dedicated OpenBao path with Kubernetes-auth ESO, railiance-platform
+declaring the policy and role, our ServiceAccount/store/ExternalSecret, and an
+attended founder step that copies the token. The drain re-reads the token file
+on every delivery, so no rollout is needed after the first sync. Stays `wait`.
+
 ## T02 — boundary-contract amendment (NET-IN-0002)
 
 ```task