Close WP-80 T20 after native and ordinary publication acceptance cb9a20f9

workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md

@@ -23,17 +23,16 @@ Updated 18 October 2026 after the founder requested clearer progress and smaller
 | --- | --- | --- |
 | Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. |
 | Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. |
-| Delivery checkpoints overall | **7 done, 1 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. |
+| Delivery checkpoints overall | **8 done, 0 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. |
 | Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. |
 | Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. |
 
-**Now - T20:** the exact founder-admitted revision has passed native activation:
-166 scanner fragments updated, 1,328 protected hook files preserved, both-version
-startup custody and actual template inheritance verified, clean/blocked/unavailable
-receive-pack and cleanup proofs passed. The two Apps declarations are published at
-2fdc198b. Ordinary Custodian publication and 40-task Hub readback remain before
-this checkpoint closes. No complete architecture gate is inferred from this scoped
-scanner migration.
+**Completed - T20:** the founder-admitted scanner revision passed native activation,
+including 166 scanner fragments, 1,328 protected hook files, both-version startup
+custody, actual template inheritance, receive-pack refusal/recovery and cleanup.
+Normal publication pushed all five queued Custodian commits; exact Hub readback
+verified all 40 task UUID/status bindings. The publication blocker is cleared.
+This scoped scanner acceptance does not close a complete architecture gate.
 
 **Next - T14/T15:** implement and verify the selected current KeyCape checks on
 ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients.
@@ -48,16 +47,12 @@ provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry t
 scope and evidence for each. The new completed records expose existing delivered
 work; they do not represent seven newly deployed systems.
 
-**Publication:** the owner source commits named below are published. Recent
-Custodian evidence is locally committed/prepared but its remote publication remains
-blocked by the unchanged live receive scanner. A local checkpoint is not a published
-or deployed result.
-
-**Hub view:** the last readback still contains the six original task records.
-Normal consistency sync attempted publication and skipped task writes after that
-push failed. The 34 new delivery records and counts above are verified in this
-source file and await normal projection; they are not yet visible as Hub tasks.
-T20 removes this publication blocker as part of its acceptance test.
+**Publication and Hub view:** normal source publication is working again.
+The five queued Custodian commits were published through c1fcd948; all 40 task
+records (six original coordination records plus 34 delivery checkpoints) are
+present in the Hub with verified source bindings. T20 is now complete. The Hub
+remains the derived view; this file owns checkpoint status. Subsequent source
+changes use the same ordinary commit/consistency path.
 
 **Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required.
 [Target and acceptance contract](../docs/netkingdom-target-security-architecture.md),
@@ -341,7 +336,7 @@ Completion test: Build the final integrated revision with pinned source/tool/dep
 
 ```task
 id: CUST-WP-0080-T20
-status: progress
+status: done
 priority: high
 depends_on: [CUST-WP-0080-T11]
 state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9"
@@ -349,7 +344,7 @@ state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9"
 
 Stage: native acceptance. Owner implementation: Forge / Apps / Repo Manager; FORGE-WP-0010-T02/T03.
 
-Completion test: [Exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation passed: exact binaries/startup, 166 hook fragments, 1,328 protected hook files, inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Remaining: ordinary Custodian source publication and exact 40-task Hub readback; keep progress until both pass.
+Completed: [exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation verified exact binaries/startup, 166 scanner fragments, 1,328 protected hook files, actual inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Normal Custodian publication pushed five queued commits through c1fcd948 and exact Hub readback matched all 40 task UUID/status bindings. See publication-readback-r1.json in that packet. Independent Forge owner accepted the native/publication returns against FORGE-WP-0010-T02/T03; that existing owner workplan remains the implementation record. Other target gates and existing residual boundaries remain open.
 
 ## T21 - Accept signed decisions at the native privileged consumers