diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
index 5cd723f..d9e6386 100644
--- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md
+++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
@@ -436,7 +436,7 @@ depending on it is the documented registration, which has been repointed.
 
 ```task
 id: CUST-WP-0067-T09
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "45a2ba22-9d50-5ba8-9fa7-6e345ddce395"
 ```
@@ -458,3 +458,25 @@ Once it serves, re-run onboarding across the 33 to project their classification.
 Acceptance: a classification PATCH succeeds against central; the 33 records
 carry their categories; the allowed-values source in the cluster is traceable
 to `the-custodian/canon/standards/repo-classification.allowed.yaml`.
+
+**Progress (2026-08-24):** delivery is built and validated. The chart carries a
+generated copy of the canon file, mounted as a ConfigMap at
+`/etc/state-hub/classification`, with `REPO_CLASSIFICATION_ALLOWED_PATH` set to
+it.
+
+The copy is the risk, so it is owned rather than trusted:
+`scripts/sync_classification_allowed.py` regenerates it from canon, and
+`--check` fails on drift. `make check-classification-allowed` and
+`make railiance-state-hub-render` both exit non-zero when the copy diverges, so
+a release cannot ship a stale vocabulary and silently validate against
+yesterday's rules — verified by injecting drift.
+
+Rendered ConfigMap parses and matches canon (version 1.0, 6 categories, 14
+domains). The `volumeMounts`/`env` blocks were merged rather than appended:
+adding a second pair would have produced duplicate YAML keys the moment `sweep`
+was re-enabled. Both `sweep` states render correctly; `helm lint` clean.
+
+**Remaining:** the release. Same shape as T08 — merge, let CI build, bump the
+tag, `helm upgrade`. Then re-run onboarding across the 33 to project their
+classification, and the local cache database finally has nothing unique left
+except the 11 dispositioned records.