diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/projection.stderr.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/.custodian-brief.md.worktree
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/.custodian-brief.md.worktree
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/WORK-RECORDS.md.worktree
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/WORK-RECORDS.md.worktree
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/originals.json
new file mode 100644
index 00000000..1e3b06c0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-backup/originals.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
+  }
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-commit.json
new file mode 100644
index 00000000..33d5578d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-commit.json
@@ -0,0 +1,13 @@
+{
+  "exit_code": 0,
+  "commit": "6201a1d2de282a218fde8d81b32f790a526942ef",
+  "base": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
+  "files": [
+    {
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
+    }
+  ],
+  "stdout": "[main 6201a1d] Record compiled any-of consumer source and actual release follow-through\n 1 file changed, 76 insertions(+)\n",
+  "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-inputs.json
new file mode 100644
index 00000000..c81cfa64
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/publication-inputs.json
@@ -0,0 +1,11 @@
+{
+  "owner": "net-kingdom",
+  "base_revision": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
+  "message": "Record compiled any-of consumer source and actual release follow-through",
+  "files": [
+    {
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/source-refinement.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/source-refinement.json
new file mode 100644
index 00000000..73f23666
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/source-refinement.json
@@ -0,0 +1,45 @@
+{
+  "base": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
+  "files": [
+    {
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
+    }
+  ],
+  "original_task_blocks_preserved": 37,
+  "source_task_count": 39,
+  "new_tasks": {
+    "NK-WP-0048-T38": "done",
+    "NK-WP-0048-T39": "todo"
+  },
+  "unrelated_state": {
+    "WORK-RECORDS.md": {
+      "worktree": "a1fec217a6e380f528778d781dbea1fc5a836fdefa1dd4dd0308100fbe08112a",
+      "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
+    },
+    ".custodian-brief.md": {
+      "worktree": "3eb7f91f2443090c9b859a716d83711310364897b6144dcf10d3254342fec3d1",
+      "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
+    }
+  },
+  "new_ids": [
+    {
+      "kind": "task",
+      "record_id": "NK-WP-0048-T38",
+      "uuid": "2c32b963-a87c-50a1-91e1-b07ea1fe4960",
+      "path": "workplans/NK-WP-0048-security-case-types.md"
+    },
+    {
+      "kind": "task",
+      "record_id": "NK-WP-0048-T39",
+      "uuid": "513c43ae-05f2-5a65-9c80-a911b7d680b8",
+      "path": "workplans/NK-WP-0048-security-case-types.md"
+    }
+  ],
+  "knowledge": {
+    "version": "0.2.6",
+    "digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "status": "withheld/orientation-only; actual INTENT and SECURITY-COMPANION reviewed"
+  },
+  "native_or_credential_actions": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/task-additions.md b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/task-additions.md
new file mode 100644
index 00000000..f6131225
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/task-additions.md
@@ -0,0 +1,74 @@
+
+## T38 — Implement and independently compile the exact any-of source candidate
+
+```task
+id: NK-WP-0048-T38
+status: done
+priority: high
+```
+
+Completed 2026-10-17, source proposal and backend verification only. Split the
+completed implementation evidence from T37. The isolated seven-path Forgejo
+11.0.3 patch introduces a separate multi-value required-claim field and CLI
+flag, preserves legacy singular behavior, and requires current well-formed
+UserInfo groups before the existing provider merges ID-token claims. The
+original exact three-group access set and groups claim remain unchanged.
+No KeyCape authorization verdict, case/type acknowledgment or deployed image
+is introduced. Existing consumer enforcement still needs the governing
+architecture/owner review; this does not satisfy the target application's
+independent Access Engine decision requirement.
+
+Candidate: Custodian `docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/`.
+Independent technical review: `forgejo-required-claim-values-review-r1/`.
+All 33 frozen packet digests and exact official-source pre/postimages match.
+The actual full patched backend executable compiles offline under verified
+official Go 1.24.3 in 304.79 seconds with sqlite/sqlite_unlock_notify tags.
+Eight source/provider fixture race tests, five actual package tests and three
+independent actual-package test functions pass; the latter include 14 named
+subtests. Full frontend/release/container build and native browser behavior are
+not claimed. The initial test-harness /dev/null Git-config failure is retained;
+its corrected scratch-only config does not modify candidate code.
+
+The technical review accepts exact source for owner integration review, with no
+formal owner assent. T39 owns reproducible release/package and image evidence;
+T37 retains architecture acceptance, actual owner integration and exact review/
+re-freeze. T34 retains real operation/inverse/session/journal/writer-exclusion
+bindings. T06's independent native first-case acceptance remains unchanged.
+
+## T39 — Package and review the actual consumer release and inverse prerequisites
+
+```task
+id: NK-WP-0048-T39
+status: todo
+depends_on: [NK-WP-0048-T38]
+priority: high
+```
+
+Implementation owner: Apps; NetKingdom coordinates the existing T37/T16 case
+contract. Next action: prepare a reproducible full frontend/backend/container
+build from T38's reviewed official-source patch through Apps' existing owner
+build path, with exact source/toolchain/dependency/base-image/output pins and
+offline verification. Do not select, publish or deploy a replacement image as
+an implied consequence of backend compilation. Prepare the concrete owner
+source/release and native change proposal after verification.
+
+Resolve the actual persisted-source inverse before any image downgrade. Helm
+chart omission and values/revision rollback do not remove the OAuth source;
+the stock older image ignores the new list field and can weaken the gate.
+Authoritative before/post/current/inverse application-source state, existing
+secret/config preservation, fresh operation/inverse sessions, durable evidence
+and effective exclusion of all release writers remain T34 obligations. Existing
+linked users/external logins can make source deletion refuse; never delete users
+or preexisting/shared sources to force an inverse. Retain the extended image
+and reconcile rather than downgrade first. Exact capability/source evidence is
+in T38's `OWNER-INVERSE.md`; list/update/delete tools alone are not admission.
+
+Completion requires the actual owner package/build/image provenance and tests,
+the explicit architecture and owner dispositions (including the single-PDP
+application profile), a verified application-state inverse path or honest
+refusal/recovery contract, and an exact bounded deployment/verification/rollback
+proposal. The chart's runtime client-secret argv confidentiality also needs its
+owner boundary resolved; reference-only source does not prove it. Native go,
+deployment and independent browser/group/revocation observations remain existing
+T06/T16 and owner gates. No credentials, image deployment or new kernel step
+is authorized by this task.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/.custodian-brief.md.worktree
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/.custodian-brief.md.worktree
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/WORK-RECORDS.md.worktree
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/WORK-RECORDS.md.worktree
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/originals.json
new file mode 100644
index 00000000..1e3b06c0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-backup/originals.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
+  }
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/.custodian-brief.md.worktree
new file mode 100644
index 00000000..1c9e6350
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/.custodian-brief.md.worktree
@@ -0,0 +1,144 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — railiance-platform
+
+**Domain:** financials  
+**Last synced:** 2026-10-17 02:33 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Prepare the exact seven private-source reader for reuse-surface
+Progress: 4/5 done  |  workplan_id: `b55a8aec-7457-563b-990b-4a55ca04d2f6`
+
+**Open tasks:**
+- ! Rotate or revoke dedicated seven-source reader within 90 days  `f0780e75`
+
+### Coordinate audit-core temporary custody and recovery exercises
+Progress: 3/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
+
+**Open tasks:**
+- ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
+  *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
+
+### Admit hourly receiver cadence and exact Qonto collector custody
+Progress: 3/4 done  |  workplan_id: `d57eeafb-c406-5e1e-841c-5d1288aacabf`
+
+**Open tasks:**
+- ► Collect actual producer and independent observer acceptance  `7d8e5315`
+
+### Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI
+Progress: 3/4 done  |  workplan_id: `04f7c4aa-0a24-5d61-994d-2487ca6bfb91`
+
+**Open tasks:**
+- ► Deploy the overlay  `94cdfd1c`
+
+### Coordinate KeyCape live Secret exposure recovery
+Progress: 4/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
+
+**Open tasks:**
+- ! T03 — Collect exact owner acknowledgements  `714ae011`
+  *(wait: Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule).)*
+- ! T06 — Publish the Railiance/OpenBao custody handoff  `3b9748c4`
+  *(wait: Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists.)*
+
+### Admit the Playwright pilot and establish scoped consumer group access
+Progress: 5/6 done  |  workplan_id: `31933d08-c877-5fda-aff9-6220c3705c92`
+
+**Open tasks:**
+- ! Connect platform identities and prove managed consumer operation  `a82762eb`
+  *(wait: User admitted all identified platform humans and coding agents; their supported Kubernetes authentication/group-mapping route remains unimplemented.)*
+
+### ArgoCD phase B: adopt the four existing Applications on railiance01
+Progress: 5/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
+
+**Open tasks:**
+- ! Adopt issue-core (from rapp-issue-core)  `0e619658`
+- ! Adopt external-secrets (highest risk)  `4ca54868`
+  *(wait: Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required.)*
+- ! Turn the root back to the production lane  `844ff115`
+  *(wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)*
+
+### Onboard rapp-policy-nexus to the ArgoCD production lane
+Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
+
+**Open tasks:**
+- ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
+  *(wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)*
+- ! Prepare the Application and the dry-run evidence  `2afb1aac`
+  *(wait: Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.)*
+
+### Close Forgejo primary backup coverage on Scaleway
+Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
+
+**Open tasks:**
+- ! Establish primary full-archive delivery and application recovery  `a4807df0`
+  *(wait: Durable scheduled caller, verified inventory and quota/retention gates remain open; September 15 prohibits expiration and scheduled secondary cutover.)*
+
+### Close S3 service assurance and ownership gaps
+Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
+
+**Open tasks:**
+- ! Make backup freshness and recurring recovery evidence checkable  `d64446fb`
+  *(wait: D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required.)*
+- ! Produce S3 signals and prove their delivery to the evidence owner  `5351e0e4`
+  *(wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)*
+- ! Obtain acceptance for compatibility assets and derived-record cleanup  `3b74f79c`
+  *(wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)*
+
+### Adopt activity-core application runtime into railiance01 GitOps
+Progress: 2/3 done  |  workplan_id: `b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54`
+
+**Open tasks:**
+- ! Observe adoption and enforce bounded promotion readiness  `63b44949`
+
+### Implement reviewed credential lanes with separate owner gates
+Progress: 7/13 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
+
+**Open tasks:**
+- ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
+  *(wait: Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.)*
+- ! Implement the platform operator-write CCR contract and Fluid lane  `f47e5bc5`
+  *(wait: Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.)*
+- ! Dispose of the ungoverned whynot-design npm duplicate  `0dd7c9a5`
+  *(wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)*
+- ! Admit the two factory audit-sender custody lanes  `0ef52c26`
+  *(wait: Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.)*
+- ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018)  `af2d4dba`
+  *(wait: Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed.)*
+- ► Implement and prove the separately approved task execution entitlement  `914bf383`
+
+### Coordinate KeyCape live Secret exposure recovery
+Progress: 4/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
+
+**Open tasks:**
+- ! T03 — Collect exact owner acknowledgements  `e019c166`
+  *(wait: Canonical RPF-WP-0027-T03: complete platform custody acknowledgements remain missing.)*
+- ! T06 — Publish the Railiance/OpenBao custody handoff  `69326850`
+  *(wait: Canonical RPF-WP-0027-T06: complete field/auth/expiry/handoff contract absent; September 15 operator block remains in force.)*
+
+### Coordinate audit-core temporary custody and recovery exercises
+Progress: 2/4 done  |  workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
+
+**Open tasks:**
+- ! T02 — Define the runtime database lease recovery exercise  `caba7fcd`
+  *(wait: Canonical RPF-WP-0015-T02: approved sender identity, fresh bounded attended window, named abort operator and live recovery receipt required.)*
+- ! T03 — Define the coordinated railiance01 reboot exercise  `09cf4065`
+  *(wait: Canonical RPF-WP-0015-T03: fresh outage approval, off-host snapshot, quorum/access evidence and owner execution required.)*
+
+### Retract public OpenBao listener behind operator-only access
+Progress: 2/3 done  |  workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
+
+**Open tasks:**
+- ! T03 — Complete the attended operator cutover  `99f8b41f`
+
+## Inbox Hygiene
+
+**Missing thread_id:** 14 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("financials")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/WORK-RECORDS.md.worktree
new file mode 100644
index 00000000..76d36c83
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/WORK-RECORDS.md.worktree
@@ -0,0 +1,176 @@
+# Work Records — railiance-platform
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | RPF-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | RPF-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| workplan | RPF-WP-0025 | finished | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
+| workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| workplan | RPF-WP-0029 | finished | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
+| workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| workplan | RPF-WP-0036 | blocked | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| workplan | RPF-WP-0038 | blocked | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
+| workplan | RPF-WP-0039 | finished | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
+| workplan | RPF-WP-0040 | finished | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
+| workplan | RPF-WP-0041 | finished | — | workplans/RPF-WP-0041-state-hub-105m-not-provisioning.md |
+| workplan | RPF-WP-0042 | finished | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
+| workplan | RPF-WP-0043 | blocked | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| workplan | RPF-WP-0044 | blocked | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| workplan | RPF-WP-0045 | finished | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| workplan | RPF-WP-0046 | finished | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| workplan | RPF-WP-0047 | finished | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
+| workplan | RPF-WP-0048 | blocked | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
+| workplan | RPF-WP-0049 | finished | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| workplan | RPF-WP-0050 | finished | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
+| workplan | RPF-WP-0051 | finished | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| workplan | RPF-WP-0052 | finished | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| workplan | RPF-WP-0053 | proposed | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| workplan | RPF-WP-0054 | finished | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
+| workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| workplan | RPF-WP-0057 | active | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | RPF-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
+| task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
+| task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
+| task | RPF-WP-0025-T03 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
+| task | RPF-WP-0027-T01 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T02 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T03 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T04 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T05 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0027-T06 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
+| task | RPF-WP-0029-T01 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
+| task | RPF-WP-0029-T02 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
+| task | RPF-WP-0029-T03 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
+| task | RPF-WP-0035-T01 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T02 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T03 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T04 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T05 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T06 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T07 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T08 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T09 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T10 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T11 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T12 | progress | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0035-T13 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
+| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T02 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T03 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T04 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T05 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T06 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0036-T07 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
+| task | RPF-WP-0038-T01 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
+| task | RPF-WP-0038-T02 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
+| task | RPF-WP-0038-T03 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
+| task | RPF-WP-0038-T04 | wait | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
+| task | RPF-WP-0039-T01 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
+| task | RPF-WP-0039-T02 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
+| task | RPF-WP-0040-T01 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
+| task | RPF-WP-0040-T02 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
+| task | RPF-WP-0040-T03 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
+| task | RPF-WP-0040-T04 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
+| task | RPF-WP-0041-T01 | done | — | workplans/RPF-WP-0041-state-hub-105m-not-provisioning.md |
+| task | RPF-WP-0042-T01 | done | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
+| task | RPF-WP-0042-T02 | done | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
+| task | RPF-WP-0043-T01 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| task | RPF-WP-0043-T02 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| task | RPF-WP-0043-T03 | wait | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| task | RPF-WP-0043-T04 | wait | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| task | RPF-WP-0043-T05 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
+| task | RPF-WP-0044-T01 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T02 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T03 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T04 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T05 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T06 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T07 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0044-T08 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
+| task | RPF-WP-0045-T01 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0045-T02 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0045-T03 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0045-T04 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0045-T05 | cancel | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0045-T06 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
+| task | RPF-WP-0046-T01 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0046-T02 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0046-T03 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0046-T04 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0046-T05 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0046-T06 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
+| task | RPF-WP-0047-T01 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
+| task | RPF-WP-0047-T02 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
+| task | RPF-WP-0047-T03 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
+| task | RPF-WP-0048-T01 | done | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
+| task | RPF-WP-0048-T02 | wait | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
+| task | RPF-WP-0048-T03 | done | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
+| task | RPF-WP-0049-T01 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| task | RPF-WP-0049-T02 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| task | RPF-WP-0049-T03 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| task | RPF-WP-0049-T04 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| task | RPF-WP-0049-T05 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
+| task | RPF-WP-0050-T01 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
+| task | RPF-WP-0050-T02 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
+| task | RPF-WP-0050-T03 | cancel | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
+| task | RPF-WP-0050-T04 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
+| task | RPF-WP-0051-T01 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| task | RPF-WP-0051-T02 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| task | RPF-WP-0051-T03 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| task | RPF-WP-0052-T01 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| task | RPF-WP-0052-T02 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| task | RPF-WP-0052-T03 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| task | RPF-WP-0053-T01 | progress | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0053-T02 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0053-T03 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0053-T04 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0053-T05 | progress | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0053-T06 | done | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
+| task | RPF-WP-0054-T01 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T02 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T03 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T04 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T05 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T06 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0054-T07 | cancel | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
+| task | RPF-WP-0055-T01 | todo | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
+| task | RPF-WP-0056-T01 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0056-T02 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0056-T03 | wait | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0056-T04 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0056-T05 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0056-T06 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
+| task | RPF-WP-0057-T01 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
+| task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| task | RPF-WP-0058-T04 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| task | RPF-WP-0058-T05 | wait | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
+| task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| task | RPF-WP-0059-T04 | progress | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
+| intake | RPF-IN-0002 | open | — | intakes/intakes.md |
+| intake | RPF-IN-0003 | open | — | intakes/intakes.md |
+| intake | RPF-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/originals.json
new file mode 100644
index 00000000..d55853d5
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-backup/originals.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 1c9e635012d170c76646bf76d5202f6de163a643 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 dc7f3aab6de945558ddb9e48a482a9d92d734c3b 0\tWORK-RECORDS.md"
+  }
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/.custodian-brief.md.backup b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/.custodian-brief.md.backup
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/.custodian-brief.md.backup
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/WORK-RECORDS.md.backup b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/WORK-RECORDS.md.backup
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/WORK-RECORDS.md.backup
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/.custodian-brief.md.worktree
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/.custodian-brief.md.worktree
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/WORK-RECORDS.md.worktree
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/WORK-RECORDS.md.worktree
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/originals.json
new file mode 100644
index 00000000..1e3b06c0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-backup/originals.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
+  }
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.json
new file mode 100644
index 00000000..3962c0d9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.json
@@ -0,0 +1,343 @@
+{
+  "repo_slug": "net-kingdom",
+  "repo_path": "/home/worsch/net-kingdom",
+  "source_revision": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-24",
+      "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']",
+      "file_path": "workplans/",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-33",
+      "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
+      "file_path": "WORK-RECORDS.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md",
+      "db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md",
+      "db_id": "",
+      "file_value": "USER-WP-0020",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md",
+      "db_id": "",
+      "file_value": "KEY-WP-0004",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md",
+      "db_id": "",
+      "file_value": "USER-WP-0020",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md",
+      "db_id": "",
+      "file_value": "KEY-WP-0004",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
+      "db_id": "",
+      "file_value": "USER-WP-0021",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
+      "db_id": "",
+      "file_value": "FLEX-WP-0009",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
+      "db_id": "",
+      "file_value": "AUDIT-WP-0003",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
+      "db_id": "",
+      "file_value": "EMAIL-WP-0004",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
+      "db_id": "",
+      "file_value": "USER-WP-0022",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
+      "db_id": "",
+      "file_value": "KEY-WP-0008",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub",
+      "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
+      "db_id": "",
+      "file_value": "CSOC-WP-0003",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md",
+      "db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md",
+      "db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md",
+      "db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-40",
+      "message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)",
+      "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15",
+      "db_id": "",
+      "file_value": "NK-WP-0048-T31",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-10",
+      "message": "Task status drift 'NK-WP-0048-T39': file='progress' db='todo' (file wins)",
+      "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T39",
+      "db_id": "513c43ae-05f2-5a65-9c80-a911b7d680b8",
+      "file_value": "progress",
+      "db_value": "todo",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub",
+      "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md",
+      "db_id": "",
+      "file_value": "RAIL-PL-WP-0002",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "a5097121-1461-59f8-81fa-e6ecef527337",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md",
+      "db_id": "",
+      "file_value": "NET-WP-0020",
+      "db_value": "NK-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md",
+      "db_id": "",
+      "file_value": "NET-WP-0015",
+      "db_value": "NK-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md",
+      "db_id": "",
+      "file_value": "NET-WP-0016",
+      "db_value": "NK-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md",
+      "db_id": "",
+      "file_value": "NET-WP-0018",
+      "db_value": "NK-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md",
+      "db_id": "",
+      "file_value": "NET-WP-0017",
+      "db_value": "NK-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md",
+      "db_id": "",
+      "file_value": "NET-WP-0019",
+      "db_value": "NK-WP",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 64/64",
+    "C-17 cleared: pushed 1 backlogged commit(s)",
+    "C-33 fixed: regenerated WORK-RECORDS.md",
+    "C-10 fixed: task 513c43ae\u2026 status \u2192 'progress'",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 27,
+    "info": 5
+  },
+  "result": "warn"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.stderr.txt
new file mode 100644
index 00000000..3345563f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/consistency.stderr.txt
@@ -0,0 +1 @@
+WARN: git commit failed for writeback: Generated-only commits rejected: staged
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/preparation.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/preparation.json
new file mode 100644
index 00000000..1cf61720
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/preparation.json
@@ -0,0 +1,9 @@
+{
+  "existing_task": "NK-WP-0048-T39",
+  "transition": "todo to progress",
+  "source_task_count": 39,
+  "prior_38_task_blocks_unchanged": true,
+  "identifiers_unchanged": true,
+  "scope": "Existing owner release source build underway; no image admission or deployment.",
+  "prepared_file": "/tmp/nk48-release-build-progress.md"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/projection.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/projection.json
new file mode 100644
index 00000000..c734169c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/projection.json
@@ -0,0 +1,987 @@
+{
+  "ok": true,
+  "status": "applied",
+  "repo_slug": "net-kingdom",
+  "commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+  "requests": 2,
+  "elapsed_ms": 16783.6,
+  "git": {
+    "upstream": "origin/main",
+    "behind": 0,
+    "ahead": 0
+  },
+  "identifiers": {
+    "schema": "repo-manager.identifier-assignment.v1",
+    "ok": true,
+    "executed": true,
+    "repo": "net-kingdom",
+    "namespace": "helixforge",
+    "assignments": [],
+    "historical_invalid_identifiers": [],
+    "historical_identity_collisions": [],
+    "files_changed": []
+  },
+  "receipt": {
+    "schema": "state-hub.repository-projection-reconcile.v1",
+    "instance_role": "primary",
+    "instance_label": "railiance01",
+    "expected_commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+    "derived_commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+    "outcome": {
+      "schema": "state-hub.projection-reset.v1",
+      "repo_slug": "net-kingdom",
+      "commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+      "status": "applied",
+      "counts": {
+        "created": 0,
+        "updated": 64,
+        "retired": 0,
+        "refused": 0,
+        "released": 0,
+        "created_tasks": 0,
+        "updated_tasks": 0,
+        "cancelled_tasks": 0,
+        "created_edges": 0,
+        "removed_edges": 0,
+        "unresolved_edges": 1,
+        "external_edges": 85
+      },
+      "created": [],
+      "updated": [
+        "NET-WP-0015",
+        "NET-WP-0016",
+        "NET-WP-0017",
+        "NET-WP-0018",
+        "NET-WP-0019",
+        "NET-WP-0020",
+        "NK-WP-0001",
+        "NK-WP-0002",
+        "NK-WP-0003",
+        "NK-WP-0004",
+        "NK-WP-0005",
+        "NK-WP-0006",
+        "NK-WP-0007",
+        "NK-WP-0008",
+        "NK-WP-0009",
+        "NK-WP-0010",
+        "NK-WP-0011",
+        "NK-WP-0012",
+        "NK-WP-0013",
+        "NK-WP-0014",
+        "NK-WP-0015",
+        "NK-WP-0016",
+        "NK-WP-0017",
+        "NK-WP-0018",
+        "NK-WP-0019",
+        "NK-WP-0021",
+        "NK-WP-0022",
+        "NK-WP-0023",
+        "NK-WP-0024",
+        "NK-WP-0025",
+        "NK-WP-0026",
+        "NK-WP-0027",
+        "NK-WP-0028",
+        "NK-WP-0029",
+        "NK-WP-0030",
+        "NK-WP-0031",
+        "NK-WP-0032",
+        "NK-WP-0033",
+        "NK-WP-0034",
+        "NK-WP-0035",
+        "NK-WP-0036",
+        "NK-WP-0037",
+        "NK-WP-0038",
+        "NK-WP-0039",
+        "NK-WP-0040",
+        "NK-WP-0041",
+        "NK-WP-0042",
+        "NK-WP-0043",
+        "NK-WP-0044",
+        "NK-WP-0045",
+        "NK-WP-0046",
+        "NK-WP-0047",
+        "NK-WP-0048",
+        "NK-WP-0049",
+        "NK-WP-0050",
+        "NK-WP-0051",
+        "NK-WP-ADHOC-2026-06-14",
+        "NK-WP-ADHOC-2026-07-02",
+        "NK-WP-ADHOC-2026-08-14",
+        "NK-WP-ADHOC-2026-08-23",
+        "NK-WP-ADHOC-2026-10-03",
+        "NK-WP-ADHOC-2026-10-10",
+        "NK-WP-ADHOC-2026-10-11",
+        "NK-WP-ADHOC-2026-10-16"
+      ],
+      "retired": [],
+      "released": [],
+      "created_tasks": [],
+      "updated_tasks": [],
+      "cancelled_tasks": [],
+      "created_edges": [],
+      "removed_edges": [],
+      "unresolved_edges": [
+        {
+          "workplan": "NK-WP-0006",
+          "from": "NK-WP-0006",
+          "target": "NK-WP-0001",
+          "reason": "missing"
+        }
+      ],
+      "external_edges": [
+        {
+          "workplan": "NK-WP-0008",
+          "from": "NK-WP-0008",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0050",
+          "from": "NK-WP-0050-T03",
+          "target": "RPF-WP-0056-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
+          "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e",
+          "to_workplan_id": null,
+          "to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f"
+        },
+        {
+          "workplan": "NK-WP-0050",
+          "from": "NK-WP-0050-T03",
+          "target": "NK-WP-0050-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
+          "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e",
+          "to_workplan_id": null,
+          "to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d"
+        },
+        {
+          "workplan": "NK-WP-0050",
+          "from": "NK-WP-0050-T02",
+          "target": "NK-WP-0050-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
+          "from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d",
+          "to_workplan_id": null,
+          "to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc"
+        },
+        {
+          "workplan": "NK-WP-0017",
+          "from": "NK-WP-0017",
+          "target": "NK-WP-0015",
+          "relationship_type": "blocks",
+          "from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6",
+          "from_task_id": null,
+          "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011",
+          "target": "NK-WP-0004",
+          "relationship_type": "blocks",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": null,
+          "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011",
+          "target": "NK-WP-0003",
+          "relationship_type": "blocks",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": null,
+          "to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T03",
+          "target": "NK-WP-0011-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908",
+          "to_workplan_id": null,
+          "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T07",
+          "target": "NK-WP-0011-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
+          "to_workplan_id": null,
+          "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T07",
+          "target": "NK-WP-0011-T04",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
+          "to_workplan_id": null,
+          "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T07",
+          "target": "NK-WP-0011-T05",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
+          "to_workplan_id": null,
+          "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T04",
+          "target": "NK-WP-0011-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b",
+          "to_workplan_id": null,
+          "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T06",
+          "target": "NK-WP-0011-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
+          "to_workplan_id": null,
+          "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T06",
+          "target": "NK-WP-0011-T04",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
+          "to_workplan_id": null,
+          "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T06",
+          "target": "NK-WP-0011-T05",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
+          "to_workplan_id": null,
+          "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T05",
+          "target": "NK-WP-0011-T04",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d",
+          "to_workplan_id": null,
+          "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T09",
+          "target": "NK-WP-0011-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
+          "to_workplan_id": null,
+          "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T09",
+          "target": "NK-WP-0011-T07",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
+          "to_workplan_id": null,
+          "to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T09",
+          "target": "NK-WP-0011-T08",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
+          "to_workplan_id": null,
+          "to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T08",
+          "target": "NK-WP-0011-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d",
+          "to_workplan_id": null,
+          "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487"
+        },
+        {
+          "workplan": "NK-WP-0011",
+          "from": "NK-WP-0011-T08",
+          "target": "NK-WP-0011-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
+          "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d",
+          "to_workplan_id": null,
+          "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+        },
+        {
+          "workplan": "NET-WP-0016",
+          "from": "NET-WP-0016",
+          "target": "NET-WP-0015",
+          "relationship_type": "blocks",
+          "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
+          "from_task_id": null,
+          "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0016",
+          "from": "NET-WP-0016",
+          "target": "NK-WP-0012",
+          "relationship_type": "blocks",
+          "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
+          "from_task_id": null,
+          "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T18",
+          "target": "NK-WP-0049-T33",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125",
+          "to_workplan_id": null,
+          "to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T18",
+          "target": "NK-WP-0049-T32",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125",
+          "to_workplan_id": null,
+          "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T35",
+          "target": "NK-WP-0049-T34",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71",
+          "to_workplan_id": null,
+          "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T33",
+          "target": "NK-WP-0049-T35",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
+          "to_workplan_id": null,
+          "to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T33",
+          "target": "NK-WP-0049-T34",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
+          "to_workplan_id": null,
+          "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T33",
+          "target": "NK-WP-0049-T36",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
+          "to_workplan_id": null,
+          "to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T33",
+          "target": "NK-WP-0049-T32",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
+          "to_workplan_id": null,
+          "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T36",
+          "target": "NK-WP-0049-T34",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc",
+          "to_workplan_id": null,
+          "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
+        },
+        {
+          "workplan": "NK-WP-0049",
+          "from": "NK-WP-0049-T03",
+          "target": "NK-WP-0049-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
+          "from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac",
+          "to_workplan_id": null,
+          "to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad"
+        },
+        {
+          "workplan": "NK-WP-0025",
+          "from": "NK-WP-0025",
+          "target": "NK-WP-0024",
+          "relationship_type": "blocks",
+          "from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc",
+          "from_task_id": null,
+          "to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0016",
+          "from": "NK-WP-0016",
+          "target": "NK-WP-0015",
+          "relationship_type": "blocks",
+          "from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150",
+          "from_task_id": null,
+          "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0006",
+          "from": "NK-WP-0006",
+          "target": "NK-WP-0005",
+          "relationship_type": "blocks",
+          "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "from_task_id": null,
+          "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0006",
+          "from": "NK-WP-0006",
+          "target": "NK-WP-0004",
+          "relationship_type": "blocks",
+          "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "from_task_id": null,
+          "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0013",
+          "from": "NK-WP-0013",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0015",
+          "from": "NK-WP-0015",
+          "target": "NK-WP-0014",
+          "relationship_type": "blocks",
+          "from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
+          "from_task_id": null,
+          "to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0017",
+          "from": "NET-WP-0017",
+          "target": "NET-WP-0016",
+          "relationship_type": "blocks",
+          "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
+          "from_task_id": null,
+          "to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0017",
+          "from": "NET-WP-0017",
+          "target": "NET-WP-0015",
+          "relationship_type": "blocks",
+          "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
+          "from_task_id": null,
+          "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0007",
+          "from": "NK-WP-0007",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0007",
+          "from": "NK-WP-0007",
+          "target": "NK-WP-0005",
+          "relationship_type": "blocks",
+          "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
+          "from_task_id": null,
+          "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0007",
+          "from": "NK-WP-0007",
+          "target": "NK-WP-0004",
+          "relationship_type": "blocks",
+          "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
+          "from_task_id": null,
+          "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0024",
+          "from": "NK-WP-0024",
+          "target": "NK-WP-0023",
+          "relationship_type": "blocks",
+          "from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e",
+          "from_task_id": null,
+          "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0015",
+          "from": "NET-WP-0015",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0015",
+          "from": "NET-WP-0015",
+          "target": "NK-WP-0012",
+          "relationship_type": "blocks",
+          "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
+          "from_task_id": null,
+          "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0018",
+          "from": "NK-WP-0018",
+          "target": "NK-WP-0017",
+          "relationship_type": "blocks",
+          "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
+          "from_task_id": null,
+          "to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0018",
+          "from": "NK-WP-0018",
+          "target": "NK-WP-0016",
+          "relationship_type": "blocks",
+          "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
+          "from_task_id": null,
+          "to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0005",
+          "from": "NK-WP-0005",
+          "target": "NK-WP-0004",
+          "relationship_type": "blocks",
+          "from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
+          "from_task_id": null,
+          "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0019",
+          "from": "NET-WP-0019",
+          "target": "NET-WP-0017",
+          "relationship_type": "blocks",
+          "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210",
+          "from_task_id": null,
+          "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0019",
+          "from": "NET-WP-0019",
+          "target": "NET-WP-0018",
+          "relationship_type": "blocks",
+          "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210",
+          "from_task_id": null,
+          "to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0018",
+          "from": "NET-WP-0018",
+          "target": "NET-WP-0017",
+          "relationship_type": "blocks",
+          "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
+          "from_task_id": null,
+          "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NET-WP-0018",
+          "from": "NET-WP-0018",
+          "target": "NET-WP-0015",
+          "relationship_type": "blocks",
+          "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
+          "from_task_id": null,
+          "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0027",
+          "from": "NK-WP-0027-T03",
+          "target": "NK-WP-0027-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4",
+          "from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447",
+          "to_workplan_id": null,
+          "to_task_id": "5b35b646-a525-55da-852a-6005613d42ea"
+        },
+        {
+          "workplan": "NK-WP-0012",
+          "from": "NK-WP-0012",
+          "target": "NK-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
+          "from_task_id": null,
+          "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0014",
+          "from": "NK-WP-0014",
+          "target": "NK-WP-0013",
+          "relationship_type": "blocks",
+          "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
+          "from_task_id": null,
+          "to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0014",
+          "from": "NK-WP-0014",
+          "target": "NK-WP-0012",
+          "relationship_type": "blocks",
+          "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
+          "from_task_id": null,
+          "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0019",
+          "from": "NK-WP-0019",
+          "target": "NK-WP-0018",
+          "relationship_type": "blocks",
+          "from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7",
+          "from_task_id": null,
+          "to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0009",
+          "from": "NK-WP-0009",
+          "target": "NK-WP-0008",
+          "relationship_type": "blocks",
+          "from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e",
+          "from_task_id": null,
+          "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0022",
+          "from": "NK-WP-0022",
+          "target": "NK-WP-0023",
+          "relationship_type": "blocks",
+          "from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da",
+          "from_task_id": null,
+          "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618",
+          "to_task_id": null
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T15",
+          "target": "NK-WP-0048-T31",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7",
+          "to_workplan_id": null,
+          "to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T25",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T29",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T24",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T28",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T30",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T26",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T16",
+          "target": "NK-WP-0048-T27",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
+          "to_workplan_id": null,
+          "to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T07",
+          "target": "NK-WP-0048-T06",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7",
+          "to_workplan_id": null,
+          "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T09",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T15",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T16",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T05",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "MASON-WP-0010-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "56cea6be-c613-586c-80cd-125340b374da"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T12",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T20",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T17",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T08",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T18",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T13",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "WARDEN-WP-0044-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T06",
+          "target": "NK-WP-0048-T14",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
+          "to_workplan_id": null,
+          "to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113"
+        },
+        {
+          "workplan": "NK-WP-0048",
+          "from": "NK-WP-0048-T14",
+          "target": "NK-WP-0048-T20",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
+          "from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113",
+          "to_workplan_id": null,
+          "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
+        },
+        {
+          "workplan": "NK-WP-0010",
+          "from": "NK-WP-0010",
+          "target": "NK-WP-0008",
+          "relationship_type": "blocks",
+          "from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74",
+          "from_task_id": null,
+          "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
+          "to_task_id": null
+        }
+      ],
+      "refused": [],
+      "notes": []
+    }
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/projection.stderr.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/.custodian-brief.md.worktree
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/.custodian-brief.md.worktree
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/WORK-RECORDS.md.worktree
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/WORK-RECORDS.md.worktree
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/originals.json
new file mode 100644
index 00000000..1e3b06c0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-backup/originals.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
+  }
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-commit.json
new file mode 100644
index 00000000..46057958
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-commit.json
@@ -0,0 +1,13 @@
+{
+  "exit_code": 0,
+  "commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
+  "base": "6201a1d2de282a218fde8d81b32f790a526942ef",
+  "files": [
+    {
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "sha256": "49f2e870bf1ba662990fa404a62d07fc72d698a6a1bcf4d5bbbe71e4c31cfec0"
+    }
+  ],
+  "stdout": "[main 201e2fa] Track active consumer release source build under the existing task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
+  "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-inputs.json
new file mode 100644
index 00000000..79835058
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-release-build-progress-r1/publication-inputs.json
@@ -0,0 +1,11 @@
+{
+  "owner": "net-kingdom",
+  "base_revision": "6201a1d2de282a218fde8d81b32f790a526942ef",
+  "message": "Track active consumer release source build under the existing task",
+  "files": [
+    {
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "sha256": "49f2e870bf1ba662990fa404a62d07fc72d698a6a1bcf4d5bbbe71e4c31cfec0"
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.md
new file mode 100644
index 00000000..8c3529a6
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.md
@@ -0,0 +1,1519 @@
+---
+id: NK-WP-0048
+type: workplan
+title: "Establish SecurityCaseTypes so that known security cases are light"
+domain: infotech
+repo: net-kingdom
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-08"
+updated: "2026-10-17"
+depends_on: []
+related_repos:
+  - ops-mason
+  - ops-warden
+  - key-cape
+  - railiance-platform
+  - informed-decision
+state_hub_workstream_id: "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb"
+---
+
+# NK-WP-0048 - Establish SecurityCaseTypes so that known security cases are light
+
+## Why
+
+The founder's direction (2026-10-08): setting up a security integration of a
+kind that has been done before should be easy, meaning accept the case, then
+ops-mason arranges it and ops-warden follows through. Setting up a new kind
+needs ample documentation and tests and an informed-decision, because its shape
+is part of the security architecture.
+
+Today every integration is hand-built: per-client helper scripts, per-lane
+custody, founder checklists. The trigger was KEY-WP-0038 (Forgejo as an OIDC
+client), whose next step was going to be yet another hand-written rollout
+script.
+
+This plan continues the pattern work of NK-WP-0008 (pattern infospace),
+NK-WP-0009 (tutorials) and NK-WP-0030 (scenario composition). It turns patterns
+into **SecurityCaseTypes** that ops-mason and ops-warden can execute. Canon:
+`canon/standards/security-case-types_v0.1.md` (proposed).
+
+Companion plans: ops-mason `MASON-WP-0010` (materialization) and ops-warden
+`WARDEN-WP-0044` (follow-through).
+
+## Tasks
+
+```task
+id: NK-WP-0048-T01
+status: done
+priority: high
+state_hub_task_id: "930ac3e9-20ec-5473-98cd-3fe8fddb730f"
+```
+
+### T01 — Accept the terminology and the canon
+
+Founder review of `canon/standards/security-case-types_v0.1.md`, including its
+section 10 open questions. On acceptance the canon status goes from `proposed`
+to `accepted`.
+
+2026-10-08: accepted by the founder (in session). Canon status `accepted`;
+section 10's open questions are carried forward to the first type (T04, T05).
+
+```task
+id: NK-WP-0048-T02
+status: done
+priority: high
+state_hub_task_id: "19c25d96-a55c-58f0-9168-3fdbc4955fc2"
+```
+
+### T02 — Inventory the de-facto types already built by hand
+
+Read-only. List every security integration built so far and group them by shape.
+Known starting points:
+
+- browser OIDC relying parties on key-cape: informed-decision-approver,
+  coulomb-social, user-engine portal, openbao-admin, and Forgejo (pending)
+- confidential service clients with `client_credentials`: secrets-engine
+  approval, requester and openbao clients, approval-engine operator
+- workload KV read lanes on OpenBao: the railiance-platform credential lane
+  designs and CCRs, for example `railiance-backup-offsite-lane`
+- short-lived SSH certificates through ops-warden (`warden sign`)
+- tunnelled operator access (ops-bridge)
+
+For each: the repositories involved, the hand-built steps, attended human steps,
+custody paths, verification evidence, and rollback (if any). Output
+`docs/security-case-type-inventory.md`, ranking candidate types by how often the
+shape recurs and how much manual work each instance costs today.
+
+2026-10-08: done, `docs/security-case-type-inventory.md`. 36 of 37 CCRs are
+already `request_type: workload-kv-read`, a de-facto type reviewed each time as
+if it were new. Browser clients: 5 hand-built plus Forgejo, each with its own
+rollout script. Confidential service clients need a registration plus two or
+three KV-read CCRs each. A forge read identity is needed in bulk by
+ORGREF-WP-0002-T06. Recommendation: oidc-browser-relying-party first (unblocks
+the forge), workload-kv-read second (largest payoff), then forge-read-identity.
+
+```task
+id: NK-WP-0048-T03
+status: done
+depends_on: [NK-WP-0048-T01]
+priority: high
+state_hub_task_id: "e487975b-73b1-516c-971d-da4cbbb93063"
+```
+
+### T03 — Schema, template and validator
+
+- `canon/schemas/security-case-type_v0.1.schema.json` and
+  `security-case_v0.1.schema.json`
+- `security-case-types/_template/` with `type.yaml`, `README.md` and tests to copy
+- a validator, extending `tools/security-scenario-composer/`, that checks a type,
+  checks a case against its type, and renders the case into the composer's
+  deterministic plan (still `execution.permitted: false`)
+
+Acceptance: the validator rejects missing sections, secret-shaped parameter
+values, unpinned providers and cases against non-`implemented` types, with tests
+for each.
+
+2026-10-08: done. `canon/schemas/security-case-type_v0.1.schema.json` and
+`security-case_v0.1.schema.json`; `tools/security-case-types/security_case_validator.py`
+(`validate-type`, `validate-case`, `render`, reusing the scenario composer);
+`security-case-types/_template/` (a valid, runnable example type over
+`net-kingdom.local-identity`, with README sections, an example case and tests that
+travel with every copy). 31 tests pass, including the composer's existing suite.
+
+```task
+id: NK-WP-0048-T04
+status: done
+depends_on: [NK-WP-0048-T02, NK-WP-0048-T03]
+priority: high
+state_hub_task_id: "2fffe112-7d55-5680-9952-78d74f44f87f"
+```
+
+### T04 — Define the first type: browser OIDC relying party
+
+`security-case-types/oidc-browser-relying-party/`, version 1.0:
+
+- parameters: client id, display name, exact redirect URIs, scopes, client type
+  (confidential or public), MFA pin, the groups the consuming service maps,
+  custody path for the secret (confidential only), consuming service and its
+  owner
+- composition: key-cape client registration (key-cape declares it as a playbook
+  capability), secret minting into custody (railiance-platform), LLDAP group
+  existence and membership (net-kingdom identity-provisioner), handover to the
+  consuming service
+- materialization (ops-mason) and follow-through (ops-warden) sections
+- verification: discovery lists the redirect URI; a test sign-in returns the
+  expected claims for one human; anonymous access to the custody path is denied
+- rollback: remove exactly this client and its custody path
+- README: threat model, MFA rationale, why redirect URIs are exact, which steps
+  still need an attended login and how that is minimised
+- reference instances: informed-decision-approver, coulomb-social, user-engine
+  portal, openbao-admin
+
+Acceptance: complete per canon section 3, tests green, status `proposed`.
+
+2026-10-08: done. `security-case-types/oidc-browser-relying-party/` 1.0 (proposed):
+`type.yaml` with 12 parameters (the custody reference is required only for
+confidential clients), composition over key-cape's new
+`key-cape.oidc-client-registration` declaration (contract PASS, `maturity:
+planned`), materialization and follow-through, verification and rollback, all
+conditional on client type where it matters. One attended step,
+`register-client`, justified by the live registry being a Kubernetes Secret.
+README with threat model, alternatives, an honest fit table (portal and vergabe
+fit; Forgejo is the first confidential case; openbao-admin, coulomb.social and
+informed-decision-approver do not fit 1.0), and known limits. Examples: Forgejo
+(checked against the accepted request) and a public portal. The validator gained
+`when` / `required_when` conditions and provider discovery. 43 tests pass.
+ops-mason's and ops-warden's sections are drafted in the type. Their owners
+review them in MASON-WP-0010-T01 and WARDEN-WP-0044-T01 before acknowledgment
+(T05).
+
+```task
+id: NK-WP-0048-T05
+status: done
+depends_on: [NK-WP-0048-T04, MASON-WP-0010-T01, WARDEN-WP-0044-T01]
+priority: high
+state_hub_task_id: "3d987d3d-0797-538b-86e4-51185a327ae2"
+```
+
+### T05 — Acknowledge the type through informed-decision
+
+Prepare the Decision Memo from the type's README and `type.yaml` and submit it
+through informed-decision's production intake. On acknowledgment the type
+moves to `acknowledged`.
+
+2026-10-08: Decision Memo prepared. Hub decision `e418263e-a71f-4f01-a970-c87c9e187c09`.
+`security-case-types/oidc-browser-relying-party/decision/`: `packet.md` (question,
+one act, what acknowledging does not do, the shape, alternatives, attended
+steps, limits, evidence), `build_intake.py` and the built `intake.json` (memo
+class `decision-record`, review group `net-kingdom-admins`, resolves the hub
+decision on answer). The envelope passes informed-decision's own
+`validate_submission`. Queuing it is an attended operator step, a write inside
+the production dispatcher pod:
+
+    kubectl -n state-hub exec -i deploy/state-hub-memo-dispatch -- \
+      python -m api.services.memo_dispatch --queue /data/private enqueue --envelope /dev/stdin \
+      < security-case-types/oidc-browser-relying-party/decision/intake.json
+
+The answer then appears for review in informed-decision.
+
+2026-10-08: queued by the founder (`pending`, `queued`) after one refusal: the
+first envelope's idempotency key was not State Hub's stable
+`state-hub.<decision>.<memo>` form, and the builder now validates against both
+sides. The dispatcher delivered it to informed-decision (ledger 7 → 8
+delivered). T05 waits for the founder's answer in informed-decision, which
+resolves hub decision `e418263e`.
+
+2026-10-08: ops-mason's review (MASON-WP-0010-T01) folded into the type, still
+1.0 `proposed`: `secret_ref` is no longer a parameter, the type derives
+`platform/workloads/keycape/{client_id}`; policies are
+`workload-kv-read-keycape-{client_id}-eso` and
+`workload-kv-read-keycape-{client_id}-{consuming_service}`, each with a templated
+body (`read` on that one data path); new `openbao_role`
+`external-secrets-keycape-{client_id}` (Kubernetes auth, ESO service account,
+15m, no default policy); catalog entry `{consuming_service}-keycape-client`;
+the two rollback steps on the KV path collapse into one metadata delete. The
+schema and validator now require a `body` on policy and role items. 105 tests
+pass. Two consequences: the delivered memo describes the type before these
+changes (a case-set custody reference, two differently named policies, no ESO
+role), so the founder answers on a superseded shape unless the memo is
+re-sent; and Forgejo's custody path moves from the accepted request's proposed
+`platform/workloads/forgejo/netkingdom-oidc-client` to
+`platform/workloads/keycape/forgejo`, which key-cape (KEY-WP-0038) and
+railiance-apps (RAPPS-WP-0016-T02) need to adopt in T06. ops-warden's review
+(WARDEN-WP-0044-T01) is still in progress.
+
+2026-10-08: revised memo `nk-wp-0048-t05-oidc-browser-relying-party-r2` built
+(`packet.md`, `intake.json`, packet `sha256:af6435e2…`); it states that it
+supersedes the first memo and passes informed-decision's and the dispatcher's
+validation. It needs a new memo id because the dispatcher refuses new content
+under a delivered idempotency key (`idempotency_conflict`). Queuing it is the
+same attended step as above. Both memos serve hub decision `e418263e`; the
+first answer resolves it, so the first memo must not stay open: an accept on it
+would acknowledge the superseded shape, and a decline would resolve the
+decision against r2. Close it with `return` (a reviewer verb that requests a
+new revision and does not resolve the hub decision; only accept and decline
+do), commenting that r2 supersedes it, then answer r2. `withdraw` exists in
+the vocabulary but is not offered to reviewers, and lifecycle `revise` only
+applies to lifecycle-registered memos, not intake-delivered ones.
+
+2026-10-09: the founder reports r2 enqueued and the first memo returned. At
+close, hub decision `e418263e` still showed `open` (not verified whether r2
+was answered or the answer is still in transit; the dispatcher ledger was not
+read). ops-warden's review (WARDEN-WP-0044-T01, ops-warden
+`history/2026-10-08-oidc-rp-follow-through-review.md`, d470f2e) arrived at
+21:25, before r2 was built, and is not in r2. Required before WARDEN-WP-0044-T02:
+R1 a per-step `lane` (missing: identity-provisioner caller credential,
+railiance-platform broker grant), R2 canon meaning of `warden_executes: true`
+(caller proxy, caller identity, no standing ops-warden token; ADR-0002), R3 a
+per-step `value_handling`. Refinements R4 (one type-level catalog lane instead
+of a per-case entry, which conflicts with ops-mason's item 5), R5 (ESO Ready gate
+before bind-env), R6 (exact accepted memberships), R7 (mfa-pinned and
+secret-delivered checks). Next: if r2 was accepted, fold R1-R3 and R5-R7 in as
+a follow-up and settle R4 between ops-warden and ops-mason before T06; if not,
+hold r2, fold them in and build r3.
+ key-cape and railiance-apps were told about Forgejo's new custody
+path.
+
+2026-10-09: r2 was not answered (hub decision `e418263e` open; dispatcher 9
+delivered), so r2 is held and r3 replaces it. ops-warden withdrew R4 for R4′
+(message a66a9204): one catalog entry per case with its body templated in the
+type. Folded in:
+
+- Canon section 3: a narrow meaning of `warden_executes: true` (caller proxy,
+  caller identity, no standing credential; ops-warden ADR-0002), plus per-step
+  `lane`, `value_handling` and an optional `ready_check`. A catalog entry body is
+  now required, like policy and role bodies.
+- Schema and validator enforce all of these.
+- The type: lanes `identity-provisioner-groups` and
+  `keycape-client-secret-generate` (both new) and `key-cape-oidc-login`;
+  `mint-secret` is `generated_in_custody`; a Ready gate on `deliver-secret`;
+  `ensure-groups` adds exactly the accepted case's memberships; new checks
+  `secret-delivered` and `mfa-pinned`; the catalog-entry body follows R4′.
+- 110 tests pass.
+
+Memo r3 (`nk-wp-0048-t05-oidc-browser-relying-party-r3`, packet
+`sha256:726dfc01…`) passes informed-decision's and the dispatcher's validation.
+The founder queues it with the same command, returns r2 with a comment that r3
+supersedes it, then answers r3.
+
+Prerequisites for T06, not for T05:
+- the two new lanes, each through its owner;
+- a founder-approved rollout of an identity-provisioner image containing
+  630ebfd (the deployed one is main-6c4fcaf from 2026-09-24, without
+  `/v1/groups/ensure`).
+
+ops-mason's request to create LLDAP group `fluid-telegram-operators` (message
+259ec26d) was answered: not possible from here by that path; the founder creates
+it in the LLDAP admin UI.
+
+2026-10-09: ops-warden finished its side of WARDEN-WP-0044-T01 (message
+`58d33f40`, commit 0e7ceb8): the revised type conforms to `warden case
+check-type`, with no further changes asked of the type. This acknowledges that
+review. Its later addendum R8 (message `af274783`, ops-warden
+`history/2026-10-08-oidc-rp-follow-through-review.md`) showed that lane
+`identity-provisioner-groups` cannot exist as declared: the provisioner's only
+HTTP credential is user-engine's runtime token, and its NetworkPolicy admits
+only user-engine pods, so a caller-proxy lane would act as user-engine. Taken
+option 1 (ops-warden's recommendation): `ensure-groups` and its rollback are
+attended, in the `register-client` session on `key-cape-oidc-login`, run inside
+the provisioner pod; no token is read. Option 2 (an operator credential of its
+own on the provisioner) stays open for a later version. `warden case
+check-type` now reports only `keycape-client-secret-generate`
+(railiance-platform) as missing. 89 tests pass.
+
+Hub decision `e418263e` was still open, so memo r4
+(`nk-wp-0048-t05-oidc-browser-relying-party-r4`, packet `sha256:452ea421…`)
+replaces r3; it passes informed-decision's and the dispatcher's validation. The
+founder queues it with the same command, returns r2/r3 if still open with a
+comment that r4 supersedes them, then answers r4.
+
+Prerequisites for T06 are now: lane `keycape-client-secret-generate`
+(railiance-platform), and a founder-approved rollout of an identity-provisioner
+image containing 630ebfd.
+
+2026-10-09: done. The founder queued r4 (`pending`, `queued`), returned r3 as
+superseded and accepted r4 in informed-decision. informed-decision's hub
+write-back is off in production (`INFD_HUB_WRITEBACK` unset), so net-kingdom
+resolved hub decision `e418263e` from the founder's report, naming memo r4 in
+the rationale. The type is `acknowledged`; it becomes `implemented` with T06.
+
+```task
+id: NK-WP-0048-T06
+status: wait
+depends_on: [NK-WP-0048-T05, NK-WP-0048-T08, NK-WP-0048-T09, NK-WP-0048-T12, NK-WP-0048-T13, NK-WP-0048-T14, NK-WP-0048-T15, NK-WP-0048-T16, NK-WP-0048-T17, NK-WP-0048-T18, NK-WP-0048-T20, MASON-WP-0010-T03, WARDEN-WP-0044-T03]
+blocking_reason: "Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status."
+priority: high
+state_hub_task_id: "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
+```
+
+### T06 — First KnownSecurityCase: Forgejo
+
+Write `security-cases/forgejo-netkingdom-oidc.yaml` from the parameters the
+founder accepted in KEY-WP-0038-T01 (`key-cape/docs/forgejo-oidc-client-request.yaml`),
+so that acceptance carries over as the case acceptance. ops-mason materializes it;
+ops-warden follows through and verifies it. The type becomes `implemented` once
+this reference case is live.
+
+This replaces the hand-built path proposed for KEY-WP-0038-T02.
+
+2026-10-09: case written, `security-cases/forgejo-netkingdom-oidc.yaml`, status
+`accepted`: the example's parameters plus the founder's 2026-10-08 acceptance of
+the key-cape request (owner and founder), with the custody-path derivation
+covered by the type's acknowledgment (memo r4). It validates and renders (plan
+`execution.permitted: false`; three attended steps on `key-cape-oidc-login`);
+it needs `--allow-unimplemented` until it is live, since it is the case that
+makes the type `implemented`. A test keeps it equal to the type's example.
+Still open before it runs: ops-mason renders and builds it (MASON-WP-0010-T02,
+T03, unblocked by T05), ops-warden plans and runs it (WARDEN-WP-0044-T02, T03),
+railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason
+`789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved
+identity-provisioner rollout containing 630ebfd.
+
+2026-10-09: identity-provisioner rolled out, founder-approved in session:
+`main-630ebfd` (`sha256:bafb4860…`, built by the image workflow) replaces
+`main-6c4fcaf` (`sha256:ffacd5d7…`; only change: 630ebfd, additive). Applied
+with `kubectl set image` on the Deployment only (generation 17 → 18, 1/1 Ready);
+the file's Service, NetworkPolicies and Ingress were not reapplied. Verified in
+the pod: `ensure_service_groups` and `revoke_service_groups` present, `/readyz`
+200; no token used, no group changed. Rollback: `kubectl -n sso set image
+deploy/identity-provisioner provisioner=forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2`.
+The pin in `sso-mfa/k8s/identity-provisioner/deployment.yaml` follows.
+
+2026-10-09: ops-warden closed WARDEN-WP-0044-T01 and shipped `warden case plan`
+(T02, message `06303d1d`); the accepted Forgejo case is refused until ops-mason
+materializes it, and a materialized copy plans cleanly once
+`keycape-client-secret-generate` exists. Its observation that `bind-env` carries
+a literal `KEYCAPE_<CLIENT_ID>_CLIENT_SECRET`: the validator now renders a
+`{param:env}` format spec (upper case, `-` as `_`, as `keycape-client.py`
+derives the name) and rejects unknown specs, and follow-through and rollback
+text is now checked for unknown placeholders too (patch-level, canon section 6).
+The type keeps the literal until ops-warden's planner (`text.format`) renders the
+spec as well; asked of ops-warden. 53 tests pass.
+
+2026-10-10: ops-warden rendered `{param:env}` in `warden case plan`
+(23ba584, message `c1df14b7`; other specs and `!conversion` refused). The type
+adopts it as a 1.0 patch (canon section 6): `bind-env` and its rollback now read
+`KEYCAPE_{client_id:env}_CLIENT_SECRET`. ops-mason reports the Forgejo case
+rendered and built (message `1ebddae9`; CCR drafts handed to railiance-platform),
+so T06 now waits on the platform apply, the mint-secret lane and the attended
+register-client session.
+
+2026-10-10: key-cape adopted the type's custody path (key-cape ab5cccd, message
+`88a4559c`): `docs/forgejo-oidc-client-request.yaml` and KEY-WP-0038-T02 name
+`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, delivered as
+`sso/keycape-forgejo-client` through `external-secrets-keycape-forgejo`, and the
+`forgejo/netkingdom-oidc-client` proposal is withdrawn. This matches the type and
+the Forgejo example; no change needed here.
+
+2026-10-10: key-cape's type-composition review (key-cape 6038483, message
+`8e5ed5f6`) found the composition sound with two blocking findings, taken as a
+1.0 patch (stricter validation and documentation, canon section 6):
+R1, redirect URIs now refuse `?` and `#` in the type pattern and in
+`keycape-client.py`'s `REDIRECT` (KeyCape refuses `?` at startup and the single
+replica would stop); R2, `allowed_scopes` always includes `groups`, the renderer
+refuses `access_groups` without it, and `access_groups` now says the consumer
+enforces the gate because KeyCape has none; R3, `mfa_required` "false" means the
+per-user privacyIDEA policy; R4, register-client's justification records the
+restart for every client, the quiet window, and that the rendered registry must
+pass KeyCape's client validation before it. The accepted Forgejo case and both
+examples still validate; 116 tests pass.
+Open, needs a decision: R2's verification step that the consumer enforces the
+group gate is a new verification step, hence 1.1 (minor), and the validator pins
+cases to the exact type version, so the accepted 1.0 Forgejo case would need
+re-pinning. Also open with key-cape: a KeyCape entry point that validates a
+rendered client registry without starting the server; until then
+`keycape-client.py` mirrors the redirect rule.
+
+2026-10-10: founder go for 1.1, so no 1.0 run overlaps. The type adds
+verification `consumer-enforces-groups`, and hand-over now requires the consumer
+to enforce `access_groups` (minor, canon section 6; risk class unchanged, no new
+acknowledgment; history in the type README). The accepted Forgejo case and both
+examples are re-pinned to `oidc-browser-relying-party@1.1` before any apply; the
+acknowledgment intake keeps `@1.0` as the record of what was acknowledged.
+ops-mason's build and ops-warden's case-ref digest predate this and need a
+re-render.
+
+2026-10-10: ops-mason re-rendered the Forgejo case from `@1.1` (message
+`22c6bba6`; plan digest `af1f4f81…`, no collisions) and rebuilt the bundle. The
+rendered OpenBao objects are identical to 1.0, so the already applied
+CCR-2026-0041 stands; 1.1 changes only consumer-side steps. key-cape shipped
+`keycape check-config` (c528daa, message `a7b0aeff`): KeyCape's startup checks
+without secret values, including the new duplicate-clientId rule.
+`keycape-client.py --check-config <binary>` now runs it on the live and the
+proposed registry, fed on stdin, and apply refuses a proposed registry that
+fails; register-client's entry point names the option (1.1 patch). The deployed
+image predates c528daa, so the binary is built from key-cape source for now.
+Before the next KeyCape rollout (Forgejo register-client or the CCR-2026-0018
+window), the attended operator runs `inspect --check-config` so the live
+registry is checked too.
+
+```task
+id: NK-WP-0048-T07
+status: wait
+depends_on: [NK-WP-0048-T06]
+blocking_reason: "The next types follow once the first one is proven end to end."
+priority: medium
+state_hub_task_id: "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7"
+```
+
+### T07 — Queue the next types
+
+From the T02 ranking, open the next type drafts (likely the confidential service
+client and the workload KV read lane), each to be acknowledged on its own.
+Record which existing hand-built instances get adopted as cases, without
+rewriting them in place.
+
+```task
+id: NK-WP-0048-T08
+status: done
+priority: high
+state_hub_task_id: "8e519082-dc8b-5e46-b660-03d03e55dcf6"
+```
+
+### T08 — identity-provisioner: ensure service-access groups
+
+The type's `ensure-groups` step calls `identity-provisioner groups ensure --groups
+<list> --members <group=user+user;...>`. The provisioner already has idempotent
+`_ensure_group` and `_add_group`, but exposes only tenant-scoped operations. Add
+the general operation (create if absent, add the listed memberships, never
+remove others), its rollback (remove only this case's memberships), tests, and
+the ops-warden route for its service identity.
+
+2026-10-08: done. `identity-provisioner/provisioner.py` gained
+`ensure_service_groups` (`POST /v1/groups/ensure`) and `revoke_service_groups`
+(`POST /v1/groups/revoke`), behind the existing service-token check. Names
+matching `tenant*`, `netkingdom-*` and `lldap_*` are reserved; members must
+already exist; everything is validated before any change; memberships are read
+back before success; nothing else is ever removed; groups are deleted only when
+asked and empty. 7 new tests (39 in the provisioner suite). The type's
+`ensure-groups` step and its rollback now name these endpoints. The ops-warden
+route for the provisioner's service token belongs to WARDEN-WP-0044-T01.
+
+```task
+id: NK-WP-0048-T09
+status: done
+priority: high
+state_hub_task_id: "0ee12dfc-8260-5038-bd39-cc7fb4113be0"
+```
+
+### T09 — The `keycape-client` entry point and its declaration
+
+Planned first as key-cape KEY-WP-0038-T04. Moved here because the machinery a
+live registration needs already lives in net-kingdom, where KeyCape is deployed
+(`sso-mfa/k8s/keycape/`): the contained kubectl, the cluster-identity pin and the
+issuer pin. A copy in key-cape would drift.
+
+2026-10-08: done. `sso-mfa/k8s/keycape/keycape-client.py` derives the KeyCape
+client record from a case (`client-from-case`). It adds or removes exactly one
+client with the existing safeguards (byte-preserving merge, exact match or
+refuse, shared-reference refusal, compare-and-swap, read-back, contained errors),
+requires the Deployment env binding first for confidential clients, and requires
+the case acceptance record for `apply` instead of a per-client founder decision
+id. 15 tests, including a regression showing that the vergabe case reproduces
+its hand-built registration exactly; all 71 helper tests pass. Declaration
+`capabilities/playbooks/net-kingdom.keycape-client-registration.yaml` (contract
+PASS, `maturity: implemented`) replaces key-cape's draft. The type now pins it,
+and for confidential clients adds `deliver-secret` (delivery from custody into
+the sso namespace) and `bind-env` (Deployment env), attended in the same session
+as `register-client`. The per-client helpers stay until their clients are
+adopted as cases.
+
+2026-10-10 — NetKingdom owner review of the execution seam, source only:
+ops-warden/docs/security-case-execution-proposal.md SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+was reviewed against INTENT, SecurityCase canon, acknowledged type1.1, current
+case and owner source. docs/security-case-execution-owner-review.md supports
+the closed adapter/receipt direction with explicit versioned schema, structural
+materialization provenance, unchanged caller/session boundaries, safe CAS
+reconciliation and exact-created-object rollback requirements. This is owner
+review, not approval. Supporting file digests are in the adjacent sources JSON.
+
+Current source exposes a circular wait: ops-mason T03 waits on mint while Warden
+and the broker refuse a non-materialized case. Structural acceptance therefore
+needs its own native pinned receipt before mint, not a successful mint before
+materialized. The platform broker additionally pins type1.0 while Forgejo is
+accepted at1.1; platform-owner alignment and tests are required, not an unchecked
+version bypass. T06 remains wait. No case/type lifecycle status, grant, authority
+or live runtime changed by this review. A proposed informed-decision would
+adopt the source contract only; native materialization and execution acceptance
+stay distinct.
+
+Final proposal re-review: staged Warden proposal SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+adds only the explicitly local reducer appendix, not an accepted wire protocol
+or executor. The exact-final review and sources JSON supersede the earlier
+1035f049... proposal review. Platform staged the exact type1.1 broker correction
+with ten fake-backend subprocess checks (script SHA256
+9576cd211cfc06526ec4cc9bd0a5b06f0f59287a68931bb2d6e3592a951ddc7d).
+The next source work is the versioned closed adapter/receipt/materialization
+contract, not another relaxation of the broker's status gate. Native work still
+requires installed broker provenance, structural reader receipts, exact new
+materialized-case bytes, caller grant/session revocation and verified execution.
+No installed/native acceptance is inferred from that staged correction.
+
+2026-10-11 — new source-only type1.2 architecture acknowledgment:
+Confirmed native founder ACCEPT of infd-20261011-forgejo-type12-source-r1@1
+at06:47:39Z, approval8e9332c8-754a-420c-b8b7-445cb4fe6765. Exact frozen packet
+0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68 and submission
+585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569; native receipt
+retained in docs/evidence/2026-10-11-forgejo-type12-source-acknowledgment/.
+The complete acknowledged1.2 source package is isolated under
+security-case-type-revisions/1.2/oidc-browser-relying-party; default loader and
+current accepted1.1 case remain untouched because load_type is single-version.
+The new proposed1.2 case is NOT accepted/materialized/live and has no acceptance
+fields. Actual reference-migration design approval is a separate Apps owner
+receipt; no1.1 approval is inherited. Source-recording review/test proof and exact
+next gates are in docs/forgejo-type12-source-acknowledgment-followthrough.md.
+T06 remains wait and T07 remains its existing dependent task; type is NOT
+implemented and no first-case/native grant or broader workplan finish is asserted.
+
+2026-10-11 — bounded explicit version selection source preparation for T06:
+The validator now offers optional exact version_roots/--version-root VERSION=PATH
+selection with duplicate/mismatch/traversal/symlink refusal and no fallback. The
+default1.1 source and historicalacceptedcase hashes/ordinaryrefusal/preparation
+render stayunchanged; actual1.1 is acknowledged, not implemented. Acknowledged1.2
+ordinaryadmission also refuses; optionalpreparation remains nonexecuting.43local
+validatorchecks pass and original1.1 CLIrenderbytes match exactly. Makerproof:
+docs/evidence/2026-10-11-explicit-type-version-selection/source-integration-validation.json.
+FormalNetownerreview/reference-source integration and all existing native adapter,
+provenance/broker/materialization/attendedproof gates remain; T06 stayswait, no
+new residual or firstcase/typeimplementation/native grant is inferred.
+
+
+2026-10-16 — isolated source preparation for T06 (canonical integration pending):
+Added `check-evidence` to the existing validator CLI. It reuses exact version
+selection and ordinary type/case/render admission, checks actual Mason structural
+request source/inventory/projection pins and reads actual Warden journal rows
+read-only. Successful rows require exact type-declared descriptors and attempt/
+revocation fingerprints. Existing acknowledged types without machine descriptors
+remain plan-only. The compatibility result never claims authenticated native
+completion: Request and journal fingerprints are not portable native evidence.
+Owner authentication/status binding and actual native gates remain unresolved;
+T06/T07 statuses and both type/case lifecycles remain unchanged. No dispatch,
+credential access or authority expansion is introduced. See tool README for the
+existing owner protocol boundaries and source integration tests.
+
+Concrete next Warden owner integration: current `Executor.admit` refuses every
+case parameter whose sensitivity is not public/operational, so browser
+`redirect_uris`, `allowed_scopes`, `client_type`, `mfa_required` (and 1.2
+`consumer_namespace`) fail after otherwise prepared admission. The sensitive
+classification is a security-change review level, not secret content. The
+Warden owner must validate through NetKingdom's existing exact-version case/type
+validator, then project only descriptor-declared safe target metadata; do not
+remove the credential/value refusal or copy complete parameters into journals.
+Actual owner descriptor acknowledgment and independent evidence admission remain
+prerequisites, with normal admission still refusing unimplemented types.
+
+
+## T10 — Source compatibility checker for Mason and Warden evidence
+
+```task
+id: NK-WP-0048-T10
+status: done
+priority: high
+state_hub_task_id: "4b06ca97-c1e4-5680-bf22-ab75ab1646a4"
+```
+
+Completed 2026-10-16 in published source `c31d21ba`. The read-only
+`check-evidence` command checks the actual Mason structural request and Warden
+journal source protocols against an exact version/render. Independent source
+review passed 103 tests at that checkpoint. It always reports native completion
+false and execution prohibited. Fixtures and local journal fingerprints do not
+provide authenticated owner/native evidence. This records completed source scope
+previously described under T06; it does not duplicate native acceptance credit.
+
+## T11 — Validate the optional machine-descriptor pin contract
+
+```task
+id: NK-WP-0048-T11
+status: done
+priority: high
+state_hub_task_id: "ef2a0119-f59e-5e45-9519-115da9df7b85"
+```
+
+Completed 2026-10-16. Reproduced the JSON schema rejecting a valid
+`execution_descriptors` map while the Python validator accepted malformed maps.
+The schema now supports the existing Warden optional exact-byte pin map; semantic
+validation binds keys to declared steps, bounds the map and checks digest shape.
+The direct evidence API refuses malformed maps before accessing them. Twenty-one
+new checks and all 127 affected source checks passed. No current type/case bytes,
+status, owner descriptors or native acceptance changed. Source evidence and
+publication receipt: Custodian
+`docs/changes/netkingdom-target-2026-10-16/browser-acceptance-next/`.
+
+## T12 — Prepare NetKingdom-owned attended step adapters
+
+```task
+id: NK-WP-0048-T12
+status: todo
+priority: high
+state_hub_task_id: "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd"
+```
+
+Owner: NetKingdom. Retained scope: prepare bounded attended Deployment env,
+config verification and restart/readiness steps around the existing helpers.
+Next action: identify exact current entry points and their revision/readback
+contracts, then implement fixed source-pinned callbacks or receipt-only attended
+steps. Completion requires positive/refusal checks, exact target/source pins and
+uncertainty behavior without acquiring user-engine runtime identity or exposing
+registry/client secrets. Existing caller/session, cluster/issuer, CAS/readback
+and status-only output boundaries remain mandatory.
+
+2026-10-16 task refinement: the original broad adapter scope is split into T13
+(completed registration source candidate), T14 (group creation provenance), T15
+(durable registration recovery) and T16 (descriptor/artifact selection and owner
+review). This preserves T12's task ID and Hub UUID while giving each remaining
+outcome an owner and completion gate. T06 now names every source dependency;
+its native/reference lifecycle acceptance scope remains unchanged. Completion
+of any source task supplies no Warden, Platform or Apps assent and no native
+execution authority.
+
+## T13 — Prepare the fixed registration adapter source candidate
+
+```task
+id: NK-WP-0048-T13
+status: done
+priority: high
+state_hub_task_id: "b264c10b-565c-5d29-b788-03cf5fbd2883"
+```
+
+Completed 2026-10-16, source implementation and synthetic fixture proof only.
+Added an injection-only adapter around actual `keycape-client.run`: fixed
+case/principal/human/lane/source/acceptance binding, existing CAS/readback,
+metadata-only owner evidence and per-attempt parent-session revocation boundary.
+The descriptor source composition pins the exact checker executable digest
+alongside adapter/helper source. Creation-only rollback authenticates its
+creation receipt and refuses changed postcreation UID/resourceVersion;
+pre-existing clients confer no rollback authority. Missing readback, evidence,
+revocation or process-local creation provenance cannot become retry-safe success.
+
+Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/`
+R3 candidate, explicit patch and postimages, retained R1 rejected custody finding
+and R2 revision, and 36 passing source checks (16 new, 20 existing). Three checks
+use actual Warden kernel admission/dispatch/rollback with published Warden
+`d97652a3bb5fa733b063d71a1b74068efcccf572` producer pins unchanged. Owner trust,
+descriptor/type/case and Kubernetes objects remain synthetic fixtures. This
+records a completed source deliverable, not independent review, publication,
+type acknowledgment, exercised procedure, identity admission or native browser
+acceptance. Independent root source review: Custodian browser-adapter-next/coordinator-review-r3.json. Source integration and normal publication/synchronization receipts: Custodian browser-adapter-next/canonical-integration.json. These receipts supply no other-owner assent or native authority.
+
+Source publication: `0775c2bfa41af236301155bb5a69bbf088bdf823`, independently
+reviewed by the Custodian coordinator before integration. The required initial
+projection and ordinary UUID writeback both completed with zero failures and
+zero automation errors. Generated-only brief commits were refused by the normal
+hook; exact pre-existing staged/working brief bytes were restored. The separate
+canonical integration receipt retains those refusals and projection evidence.
+Native admission and all other-owner acceptance remain open.
+
+## T14 — Admit governed group rollback against native owner boundaries
+
+```task
+id: NK-WP-0048-T14
+status: progress
+depends_on: [NK-WP-0048-T20, NK-WP-0048-T21]
+priority: high
+state_hub_task_id: "fce95440-a25b-5f27-8ef3-a3d182099113"
+```
+
+Owner: NetKingdom. Next action: bind the completed T21 PostgreSQL journal to
+an admitted dedicated CNPG consumer through the existing `rapp-postgres`
+database-per-consumer contract. Identify the actual deployment/package and
+custody owner, admitted placement/capacity and role/renewable lease/TLS target;
+implement the independently retained exact content checkpoint and authoritative
+tenant/case/source/principal callbacks before enabling governed group operations.
+The injection-only backend and fixture callbacks do not supply production scope
+or authorization. Existing service tokens, caller-supplied JSON and provenance
+receipts confer no new grant. The default production endpoint remains disabled
+without the trusted integration. SQLite remains local/disposable only; any
+production exception requires explicit scoped governance under ADR-0015.
+
+2026-10-17 owner-integration refinement: T23 records the completed source/package
+placement review, distinct from T21's source/disposable-SQL proof. Its dedicated
+`rapp-identity-provisioner` recommendation is draft and unbound, not an accepted
+package or existing repository. The full six-consumer rapp-postgres renderer
+accepts the inert candidate on platform-pg-2 as its third of four declared
+consumers; first-cell placement is refused as a fifth. Neither the estimated
+four-consumer ceiling nor source requests establish native headroom or backup.
+
+Next independent owner contracts: NetKingdom/package/substrate owners accept
+exact deployment/rollback fate; rapp-postgres admits the dedicated consumer,
+roles, five-connection budget and actual backup/restore; Platform admits exact
+renewable runtime/migration delivery and TLS/CA/SAN; network owners scope SQL,
+broker and checkpoint paths without assuming a narrow policy subtracts additive
+same-namespace access. Protected caller owners must provide authoritative
+GroupJournalBinding construction and current authorization; an independent
+existing holder must authenticate and atomically advance the exact content
+checkpoint, not a counter or ordinary Audit receipt. Directory/runtime owners
+must select and prove either an exclusive all-writer maintenance barrier or
+provider-supported CAS/generation, including established sessions, lifecycle
+cascades and remove/readd ABA. No source review establishes those owner facts.
+
+The default PostgreSQL activation and destructive native rollback remain refused.
+Storage/lease acceptance can be proposed separately from LDAP mutation only after
+exact owner source/target/custody/verification/recovery and cost/risk review;
+State Hub guard approval grants none of it. Source-only integration review and
+native acceptance matrix: Custodian native-storage-r1/OWNER-REVIEW.md. T14's
+existing status, UUID, dependencies and native completion gate are retained.
+
+2026-10-17 refinement: T20 retains the historical durable SQLite source and
+actual disposable LLDAP proof. T21 extracts the completed PostgreSQL source and
+bounded real disposable SQL compatibility proof. T14 remains `progress` for
+native CNPG admission/recovery, protected owner integration and exclusion of all
+external LDAP writers. Separate source publication/projection and independent
+cleanup receipts belong to coordinator follow-through; no missing native assent
+is represented as received.
+
+Completion still requires independently reviewed/admitted ADR-0015-conforming
+CNPG storage (or an explicit governed exception), backup/lost-store recovery and
+migration of legacy requests; a native
+writer-isolation/fencing or provider CAS/version contract that closes external
+writer races and remove/re-add ABA; exact case/source/principal and current
+native object bindings for protected callbacks; and actual per-attempt evidence,
+revocation and readback/refusal verification through the existing owner paths.
+Only independently retained confirmed creations may be undone. Every
+pre-existing/shared group and membership must remain preserved; unresolved
+intents never expire into retry authority. The disposable fixture supplies none
+of these native custody, authorization, owner-acceptance or production claims.
+
+## T15 — Define authenticated recovery for lost registration process state
+
+```task
+id: NK-WP-0048-T15
+status: wait
+depends_on: [NK-WP-0048-T31]
+blocking_reason: "Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source."
+priority: high
+state_hub_task_id: "1b825705-4848-5edc-832f-b1622cd9bdb7"
+```
+
+2026-10-17 source part merged (061461e via 65559ef). `build()` takes optional
+paired `holder`/`observe` capabilities and installs `reconcile_original`; the T31
+fixtures now run through the adapter's own path. Rollback after restart is still
+refused, and there is no add replay. This changes `keycape-registration-adapter.py`,
+so the revision reviewed under Custodian `browser-adapter-next/coordinator-review-r3.json`
+is superseded. The new revision has no independent review yet and must not be
+pinned on the strength of the old one.
+
+2026-10-17: T31 fixtures done (74adcd7). What remains for T15: the owner
+selects the real authenticated original-attempt holder, and the T13 adapter
+gains the holder capability, `reconcile_original` and reconcile-aware `verify`
+described in T31.
+
+Owner: NetKingdom for registration state, with Warden owning kernel evidence
+admission. T22 records the completed source review and exact existing-seam gaps;
+T15 retains implementation and authenticated restart/lost-receipt acceptance.
+Next action: select and admit the actual owner publisher/authenticator and bounded
+original-attempt readback contract for the merged holder/observe adapter seam.
+Warden's original-intent persistence/interface (`a45cf475`) and additive validation
+(`117fec9241e7b985dfb187b992e173d0a5dc3700`) are now published and projected.
+The local Journal retains admitted nonsecret original context, validates original
+actor/attempt and metadata linkage to the original running receipt, and supplies
+it separately from the new reconciliation attempt. This local consistency is not
+independent original-holder authorization or creation provenance; neither the
+journal nor a current matching registry entry reconstructs creation authority.
+
+The owner contract must bind the original Invocation, case/type/descriptor/catalog/
+acceptance pins, source, principal and admitted tenant/realm provenance, separately
+from the new reconciliation attempt and its independently revoked parent session.
+Use an existing authenticated holder/readback; Audit Core's custody API is a
+candidate only until its actual registration source/class, load-bearing emission
+contract and separate scoped reader are admitted. No new broker or receipt trust
+root is proposed. A missing original record, ambiguous publication, NO_CHANGE,
+changed native revision or lost readback stays uncertain; no add replay or undo.
+
+Completion requires restart/lost-receipt fixtures against the selected actual owner
+contract: independently authenticated original created-only provenance, original
+exact client entry and unchanged current postcreation UID/resourceVersion before
+any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
+The merged T13 adapter exposes reconciliation only through paired injected
+holder/observe capabilities and still refuses post-restart rollback. Existing
+source review, JSON receipts and synthetic trust do not satisfy independent
+holder authorization/provenance or native admission, or authorize attended recovery.
+Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
+
+2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
+is not published — ops-warden head is `d97652a`, with no WARDEN-WP-0044-T03
+commit, and the net-kingdom inbox holds no announcement. No restart/lost-receipt
+fixture or readback seam was added this session; the work is deferred behind
+T16's decomposition under the same token budget. Remains todo, gated on Warden
+publishing the reviewed lookup/context interface and on owner selection of the
+authenticated original-attempt holder.
+
+2026-10-17 current-source correction: the earlier same-day `d97652a` lookup
+checkpoint and T31 adapter-next-action note above are historical and superseded
+by the published Warden interface/validation and merged `061461e` adapter seam.
+The 54 focused Warden checks establish source behavior only. Current admission
+leaves tenant/realm empty; no admitted tenant/realm provenance is inferred.
+T15 remains wait for actual independently authenticated owner-holder/readback
+selection, independent review of the changed adapter, and native restart/lost-
+receipt acceptance. Existing task metadata, owner gates and historical reviews
+are unchanged.
+
+## T16 — Select and review the actual machine descriptor composition
+
+```task
+id: NK-WP-0048-T16
+status: todo
+depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29, NK-WP-0048-T30]
+priority: high
+state_hub_task_id: "200bf500-5084-5ae7-be26-3033fe1f296e"
+```
+
+2026-10-17 coordinator review r4 approved the 1.3 candidate at 1920b13 with no
+findings (the-custodian `nk48-adapters-1.2-review/coordinator-review-r4.json`). The founder chose
+option A of the T16 owner-review packet (`nk48-t16-owner-review/founder-option-decision.md`):
+1.3 with execution descriptors for all seven steps. Owner reviews for A are open
+in the-custodian `docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/` (net-kingdom,
+railiance-platform, railiance-apps, ops-warden, key-cape). The owner-review packet
+supersedes the r1 composition pointer: T16's exact composition is now
+`sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json`.
+
+2026-10-17 successor candidate prepared (source only, `proposed`):
+`security-case-type-revisions/1.3/oidc-browser-relying-party/` is the 1.2 package plus
+an `execution_descriptors` map of the seven composed descriptors, with examples
+pinned to `@1.3` and no acknowledgment. ensure-groups, hand-over,
+deliver-consumer-secret and the composer accept 1.3 (835680c, merged acda26c).
+`test_admit_1_3_type.py` runs Warden's real admission against the committed 1.3 type:
+the proposed type is refused; an acknowledged copy is refused because ops-warden
+pins parameter fingerprints only for 1.1 and 1.2; and with only a 1.3 pin (equal to
+1.2's fingerprint) all seven are admitted. This is a major change under canon
+section 6. Next: r4 source review of the changed adapters and the map, then owner
+reviews, including the ops-warden 1.3 pin, the mint-secret warden_executes/human
+question and the owner-run steps question, then the founder's Decision Memo.
+
+Owner: NetKingdom for descriptor/type source and exact checker artifact; Warden
+independently owns global provenance/admission. T22 records the completed seven-step
+source1.2 inventory and regenerated register-client descriptor using the delivered
+checker and current sealed-snapshot source; T16 retains exact owner review,
+complete descriptor composition and admission. Next action: bind actual native
+publisher/authenticator, original/current session verification and revocation,
+executable storage/custody and config pins, then obtain the six missing fixed
+owner descriptors/adapters for ensure-groups, mint-secret, deliver-secret,
+bind-env, deliver-consumer-secret and hand-over. The inventory identifies each
+existing owner seam, exact missing contract and created-only rollback requirement;
+it is not an executable bundle. T14 and T15 remain independent prerequisites.
+
+Review the dedicated consumer source1.2 composition only through the existing
+explicit version-root selection. Keep canonical1.1/default and its accepted case
+unchanged, and the source-only acknowledged1.2 reference case proposed without
+acceptance fields. New descriptor bytes require a reviewed exact successor
+revision/version under canon section6; they do not inherit historical source
+acknowledgment. Changed authentication/materialization/trust needs the prescribed
+informed-decision acknowledgment. Do not insert a partial descriptor map or use
+--allow-unimplemented preparation as ordinary case/native admission. The registry
+helper reports restart_required; separately review quiet-window restart/readiness
+and actual consumer verification rather than infer activation from registry CAS.
+Exact composition: Custodian native-registration-r1/descriptor-composition.json.
+Completion requires separate owner source review of exact machine descriptors,
+artifact/source/config pins, normal type/version admission and independent
+evidence-verification boundaries. Warden d97652a refreshes producer validator
+pins for NetKingdom 015694ee; it does not attest T13's new adapter. Pinning any
+machine descriptor into an acknowledged type is a separately reviewed source
+change. Platform owns structural/mint/broker/delivery evidence; Apps owns actual
+consumer login/group enforcement. Neither their assent nor native acceptance is
+supplied by this task.
+
+2026-10-16 source checkpoint: T19 below extracts the completed per-attempt
+executable snapshot implementation and reviewed fixture proof. T16 retains
+native executable storage/custody, exact owner evidence/session callbacks,
+complete descriptor composition and ordinary type/version admission. The
+successor descriptor/source pins are proposed only; the earlier descriptor
+history is preserved. T14 group provenance and T15 durable restart/recovery
+remain independent open requirements. No native acceptance is counted here.
+
+2026-10-17 budget checkpoint (net-kingdom-worker): no source change made. The
+T13 registration adapter alone is 217 source and 317 test lines plus an
+independent review; six further owner descriptors/adapters cannot be completed
+within one per-task token budget (soft 8000 / hard 10000), so the task was
+stopped below 50% and is decomposed rather than pushed through. Proposed split,
+one source-candidate task each with positive/refusal fixtures, canonical1.1
+default unchanged and no --allow-unimplemented admission: (a) ensure-groups,
+bound to T14's journal/provenance seam; (b) mint-secret and (c) deliver-secret,
+Platform-owned evidence seams; (d) bind-env and (e) deliver-consumer-secret;
+(f) hand-over, Apps-owned consumer verification; then (g) descriptor composition
+over the reviewed set. Each candidate needs its owner's source review before
+pinning; none is authored here as owner-accepted. Status stays todo.
+
+## T17 — Build and exercise the exact offline config-checker artifact
+
+```task
+id: NK-WP-0048-T17
+status: done
+priority: high
+state_hub_task_id: "8c3e4baa-a218-5996-af9e-fe1153a46dac"
+```
+
+Completed 2026-10-16, isolated artifact/source fixture proof only. Built the
+existing `key-cape/src/cmd/keycape` command from published clean source revision
+`3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, source tree
+`f0010b9cab17dbc3a787628a29657d98b900320f`, with cached Go 1.23.0,
+CGO disabled, Linux/amd64 v1, trimmed paths, disabled VCS stamping and offline
+read-only module selection. The full retained closure pins 108 source files,
+9876 toolchain files and ten used module source directories. Three isolated
+build locations produced identical 13633409-byte artifacts:
+`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
+
+Eight disposable checks use the actual executable and maintained helper/kernel,
+with complete synthetic configs and a minimal environment: add/created-only
+removal, normal pinned producer admission, rollback, lost-readback uncertainty,
+stale revisions, substituted checker refusal, invalid startup config and missing
+secret-env refusal. No checker stub or producer-pin override remains. The
+artifact-bound descriptor proposal is
+`sha256:76b1153d188062ece53fcd5e8d35290fdbfd02a69dd79d4b001fc42781afcdc3`.
+Evidence: Custodian
+`docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/`.
+The first two build attempts succeeded but their closure collection failed;
+both failures are retained, as is refusal of the older incomplete synthetic
+fixture. No production config, credentials or cluster mutation was used.
+
+This extracts completed build/fixture scope from T16 without claiming KeyCape
+owner endorsement, native checker selection/storage custody, acknowledged type
+integration, native evidence/session callbacks or attended browser acceptance.
+T16 retains exact owner review and composition/admission scope. The attended
+registration procedure remains unexercised.
+
+## T18 — Make checker input and executable selection deterministic
+
+```task
+id: NK-WP-0048-T18
+status: done
+priority: high
+state_hub_task_id: "9c45da71-fb4c-5f20-9065-90f448f37c64"
+```
+
+Completed 2026-10-16, isolated source correction and real-artifact fixture proof
+only; independent integration/publication remain separately recorded. KeyCape
+source review identified non-secret `KEYCAPE_ACCOUNT_PORTAL_URL` and
+`KEYCAPE_BROWSER_LOGOUT_URL` overrides in config.Load. The original helper
+inherited ambient environment, allowing valid supplied configuration to be
+rejected or invalid supplied URL configuration to be admitted. A bare relative
+checker filename could also be replaced by PATH lookup after the adapter had
+hashed the selected local file. All three counterexamples are retained against
+the unchanged predecessor.
+
+The existing helper now resolves the selected checker file to an absolute path
+and passes an explicit empty subprocess environment. Three opt-in real-checker
+regressions verify both URL-verdict directions and relative-file selection under
+a non-checker PATH decoy. All 39 affected checks pass with the exact supplied
+artifact, as do 11 real-artifact helper/kernel scenarios. Source evidence:
+Custodian `docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/`.
+Historical descriptors remain retained; the helper correction changes successor
+source-composition pins and requires their separate review/admission. An absolute
+path is not immutable custody and does not eliminate file replacement races;
+T16 retains native executable storage/custody and callback/type admission.
+No production configuration, credentials or cluster mutation was used.
+
+Source integration and publication: `916ba4b33e03179274d03b78bd898a4843e8653f`, following independent
+Custodian source review in browser-checker-environment-r2/coordinator-review.json.
+The ordinary protected projection pass assigned T17/T18 UUIDs with zero failures
+and zero automation errors; generated-only brief commit refusal is retained.
+The exact prior staged/working brief bytes were restored. Final source/publication/
+projection evidence is retained in Custodian browser-checker-environment-r2/
+canonical-integration.json. These source receipts do not admit native executable
+custody, owner callbacks, acknowledged type changes or browser identities.
+
+## T19 — Bind checker execution to verified immutable attempt bytes
+
+```task
+id: NK-WP-0048-T19
+status: done
+priority: high
+state_hub_task_id: "f50fdcd1-00be-5c3c-be0c-345aa2126032"
+```
+
+Completed 2026-10-16, independently reviewed source implementation and synthetic
+fixture proof only. The registration adapter now opens a bounded regular checker
+artifact without following its terminal symlink, verifies the reviewed digest,
+and snapshots the exact bytes into a write/grow/shrink/seal-removal-sealed Linux
+memfd before helper access. Live and proposed config checks execute that same fd
+through procfs with the existing empty environment; the fd closes on completion
+or failure. Unsupported snapshot/seal/exec policy refuses through the existing
+parent-session revocation and uncertainty boundaries. The earlier unbounded
+pre-snapshot path read was removed during independent review; actual adapter
+symlink/FIFO/oversize refusal tests verify helper access never starts.
+
+Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/`,
+including exact base/preimages/postimages/patch, proposed descriptor, coordinator
+source review and canonical integration receipt. Independent Custodian checks
+passed 49 affected source tests and 12 actual Go checker/helper/kernel scenarios;
+the sets overlap and are not separate acceptance counts. Existing published
+Warden d97652a producer pins remain unchanged. The exact KeyCape artifact remains
+`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
+The predecessor path-replacement refusal and the first expanded reopened-fd test
+failure are retained; the latter fixture was corrected to restore write mode
+before independently proving seals block reopened-fd writes and shared mmap.
+
+This source task adds no native owner custody, callback, evidence trust, type
+acknowledgment, credential access, consumer sign-in or rollback acceptance.
+Executable memfds, Linux seals and usable procfs are explicit runtime dependencies
+and still require native admission. This is an extracted source outcome from
+T16, not completion of T16; T12/T14/T15 and all external-owner gates remain open.
+
+
+Publication verified by the coordinator after the source worker usage limit:
+`8790dd18ae83c4651ef3d1d923312a118a5b436b` is the actual remote main revision.
+All five canonical source hashes match the reviewed packet. Normal synchronization
+completed with zero failures/automation errors; all 19 task statuses match the
+projection. T19's assigned UUID is retained. The original staged and working brief
+bytes were restored and independently compared. The exact source, projection and
+publication checks are in Custodian browser-resume-r1/canonical-integration.json.
+Native acceptance remains open under T16 and the other named owner tasks.
+
+
+## T20 — Prepare durable group provenance and prove disposable LLDAP compatibility
+
+```task
+id: NK-WP-0048-T20
+status: done
+priority: high
+state_hub_task_id: "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
+```
+
+Completed 2026-10-17, source candidate preparation and bounded synthetic
+compatibility proof only. This extracts evidenced implementation/fixture scope
+from T14; T14 retains native storage, writer isolation, protected callback and
+owner-acceptance gates. Source integration/publication and State Hub projection
+are pending the coordinator's separate receipts; no revision or task UUID is
+invented here.
+
+The existing identity-provisioner group ensure/revoke interface now has a
+reviewed candidate for a bounded owner-private SQLite journal, proven only in
+local/disposable use. The initial storage instructions wrongly suggested a native
+persistent-volume path; source review against accepted ADR-0015 corrected them
+before publication. Production SQLite-on-a-PVC is not admitted: T14 retains
+CNPG/rapp-postgres storage admission or a separately governed exception.
+The local journal saves
+complete prestate and intent before each attempted directory mutation, inventories
+only confirmed new groups/memberships, binds original ensure idempotency and
+correlation to the exact request digest, and refuses unsigned caller inventories
+or legacy broad revoke requests. Replays never recreate removed state. Missing,
+replaced or untrusted storage and missing intent rows stop execution; definite
+before-mutation refusals retain evidence without stranding unrelated valid work.
+Interrupted writes/readback remain unresolved across reopening. Revoke validates
+all targeted native ids and complete member postimages before destructive work,
+removes only confirmed creations and never deletes a preexisting empty group.
+Server/configuration wiring, image-copy closure and owner storage/request
+migration instructions are included. The existing endpoint's caller
+authentication remains the existing boundary, not a new grant.
+
+The candidate was prepared against NetKingdom
+`878abc93588e12b6da1bac055cfbb3abb8d7adf1`; exact source patch digest
+`sha256:1f3f3ca94c46dadac8f24896053d4d23179de795e50a24298a0cfbcc46cca30e`.
+The independent Custodian review passed all 65 provisioner checks. The earlier
+62-check candidate, two independent-review findings and subsequent fixes remain
+retained rather than overwritten. Seven additional fixture-plan checks exercise
+the preparation boundary; these counts overlap the same candidate and do not
+measure task-completion percentage or independent acceptance.
+
+A separately reviewed bounded fixture then exercised the exact candidate against
+cached pinned disposable LLDAP and Python images, through actual GraphQL. All 14
+closed compatibility/containment oracles passed: exact creation inventory,
+separate-process SQLite reopening/replay/revoke, complete preexisting directory
+preservation including empty/shared groups and memberships, refusal of shared
+membership drift, retained uncertainty after a lost response following a real
+addition, and refusal of unknown/cross-case receipt bindings. The fixture used
+only newly generated synthetic users/passwords/key material in private tmpfs,
+with a network-none anchor and shared loopback helper, no host ports/mounts,
+no image pulls and no production or actual credential contact. The coordinator's
+safe receipt reports both exact owned containers absent after cleanup; final
+independent cleanup verification remains the coordinator's integration duty.
+
+Evidence: Custodian
+`docs/changes/netkingdom-target-2026-10-16/group-provenance-r1/`, including exact
+source base/pre/postimages, patch/manifest, independent review and retained
+refinements. Native fixture manifest
+`sha256:8a0514f5f14137355972400cd4852f48c892316d28e3abd3c86635d7cb81eef2`;
+retained safe result `native-fixture/execution-result.json` (original
+`/tmp/nk48-groups-native-review-5pywb19z/result.json`). The source task supplies
+no native owner assent, production rollout, protected session/evidence callbacks,
+ordinary type admission or consumer login proof. LLDAP has no conditional
+membership mutation or generation token here: exact readback cannot exclude
+ABA or a concurrent external writer, so T14 remains open.
+
+2026-10-17 verified source follow-through: source commit `4f65e41` passed normal
+local scanning and all 65 canonical provisioner tests. The actual disposable
+LLDAP receipt passed all 14 oracles; independent verification on the pinned
+daemon found both exact names and the run label absent. Source integration
+includes the ADR-0015 documentation correction; the journal remains local-only.
+
+T14 source preparation is underway. Twenty-three pinned public sources identify
+NetKingdom implementation/reconciliation, Platform custody/database governance
+and rapp-postgres consumer provisioning; the inspected runtime binding does not
+assign identity-provisioner a package. The existing User Engine runtime token
+and pod route are not a protected-case caller lane. The native proposal preserves
+the same journal seam on a dedicated CNPG consumer and requires authoritative
+scope binding, admitted role/lease/placement/recovery and all LDAP writers fenced.
+The declared exclusive maintenance window is not mechanical exclusion of WebUI,
+helper or lifecycle writers. Capacity placement and EUR cost/risk remain owner
+decisions. No package, database, credential, rollout or owner assent was created.
+Custodian evidence: group-provenance-r1/native-storage-proposal-r1; final source,
+projection and cleanup review: resume-integration-r1/publication-verification.json.
+
+
+## T21 — Implement the PostgreSQL journal and prove disposable SQL compatibility
+
+```task
+id: NK-WP-0048-T21
+status: done
+depends_on: [NK-WP-0048-T20]
+priority: high
+state_hub_task_id: "afe78e4d-408a-516a-ab92-e212e8a2d11d"
+```
+
+Completed 2026-10-17: bounded source preparation and actual disposable PostgreSQL
+compatibility only. T14 retains native storage, custody, callbacks, authorization,
+all-writer isolation and production admission. Coordinator source publication and
+projection remain separate follow-through; no source revision or task UUID is
+invented here. T20 remains the historical local SQLite/actual LLDAP proof.
+
+The eight-path source candidate adds an injection-only PostgreSQL implementation
+behind the existing owner journal seam, with explicit trusted tenant/directory/
+case/source/principal/epoch binding and independent continuity callbacks. It
+persists bounded intent/created-only receipts, exact-one version updates, durable
+active fences, and a content-bound journal chain. SQL commits precede independent
+exact-marker acknowledgment; lost replies/checkpoints poison continuation and
+retain uncertainty. A counter-only checkpoint is explicitly insufficient for
+divergent clones. Migration does not create database/schema/credential, admit an
+epoch or clear quarantine; production HTTP activation is absent pending trusted
+callbacks. Pinned psycopg package/image-copy closure is included, without claiming
+an image build or native dependency admission.
+
+Candidate base `6cb43c0cc55212363a5406b02db046e2384a7c40`; final eight-path patch
+`sha256:5549d2982b61ff70aba4b3928fecd5639db0f1a732ab2f8630f678e7acf4d34d`.
+All 82 source tests pass, alongside 13 fixture plan/diagnostic checks and two
+source-backed snapshot regressions. Counts overlap the same source and fixture;
+they are not additive native acceptance or completion percentages.
+
+The independently reviewed R5 fixture ran the actual SQL migration/backend and
+existing provisioner path against cached pinned disposable PostgreSQL. Directory
+operations deliberately used the existing synthetic LLDAP test double. All
+manifest-declared phase oracles passed: creation-only inventory and DDL refusal;
+separate-process replay/revoke with complete preexisting/shared visible-state
+preservation; foreign-context refusal; concurrent exactly-once reservation and
+stale version refusal; actual database fork with divergent bodies at the same
+counter and fresh-object rejection of the losing exact checkpoint; retained
+uncertainty after checkpoint/directory/SQL response loss; and actual pg_dump/
+pg_restore rollback refusal against the independently retained fixture checkpoint.
+The checkpoint is fixture-only, not an admitted native owner evidence holder.
+
+Only generated credentials/state were used, with two nonroot/read-only containers
+on private loopback, bounded tmpfs/CPU/memory/PIDs/lifetimes, no host ports/mounts,
+no pulls and no production contact. The safe receipt reports both exact owned
+containers absent, with no daemon uncertainty. Independent final pinned-daemon
+cleanup verification remains coordinator follow-through.
+
+Failed R2/R3/R4 receipts and source revisions remain retained. R2's helper failure
+subphase is unknown; R3 exposed a real backend bug where replacing nested receipt
+objects lost the created ID held by ensure, fixed by acknowledging only the backend
+version after commit/checkpoint. R4 verified that fix through actual SQL bootstrap,
+then exposed fixture snapshot aliasing and empty deleted-group backing entries;
+source-backed regressions corrected the snapshot without weakening complete
+visible-prestate equality, and reject nonempty orphan membership. These refinements
+belong to one trial, not extra native acceptance successes.
+
+Custodian evidence: `docs/changes/netkingdom-target-2026-10-16/group-postgres-r1/`;
+exact source/pre/postimages and retained predecessors; native R5 manifest
+`sha256:d51f90816616848b93bcdc482e10a98d07061deb01eeed9e50700fc6e68b6051`;
+`final-integration-r1/typed-execution-evidence.json` and byte-exact safe receipt
+(original `/tmp/nk48-postgres-native-review-sguj7t8p/result.json`). No CNPG native
+storage/HA/backup/lease/TLS/capacity/restore admission, authoritative protected
+callbacks, real LDAP writer fencing/CAS/ABA exclusion, owner assent or production
+endpoint activation is claimed. Those remain live T14 work.
+
+
+## T22 — Establish registration recovery source gaps and complete descriptor review inventory
+
+```task
+id: NK-WP-0048-T22
+status: done
+priority: high
+state_hub_task_id: "ea50d93b-0d04-55d2-98c4-9b6c3fe925b1"
+```
+
+Completed 2026-10-17: source-only owner-contract review and complete review
+inventory. Inspected the actual registration adapter, Warden Journal/Executor,
+NetKingdom evidence compatibility checker and Audit Core custody/read surfaces.
+No existing admitted holder/readback supplies authenticated original-attempt
+recovery: payload/creation are process-local, persisted evidence references are
+hashed, and reconcile receives a new attempt without original context. The exact
+four-owner contract requirements and non-replayable missing/ambiguous cases are
+recorded; no recovery callback, publisher, credential grant or native trust root
+was installed. T15 retains implementation and actual acceptance.
+
+The complete source1.2 inventory maps all seven follow-through steps to their
+existing owners, missing exact contracts and created-only rollback requirements.
+The actual maintained adapter regenerated the sole existing register-client
+machine descriptor against the delivered 13,633,409-byte checker and current
+sealed-memfd snapshot source. The checker rehash and Warden Descriptor.decode
+round-trip passed; six owner descriptors remain absent. Actual source commands
+render canonical1.1 and explicitly selected1.2 with execution.permitted false;
+ordinary1.2 case admission still refuses its acknowledged/unimplemented type.
+Canonical type/case/acknowledgment bytes were hash-checked unchanged. No tests were
+added or rerun, no native configuration or effect occurred, and no owner assent
+or complete machine bundle is claimed. T16 retains native executable custody,
+complete exact descriptors, independent source review and normal version/type
+admission. This extracted outcome supplies no native gate completion credit.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-registration-r1/`, especially
+original-attempt-review.json, descriptor-composition.json, source-verification.json,
+source-manifest.json and manifest.json. The prior sixteen-gate audit remains
+immutable. Publication, normal task UUID allocation and projection are separate
+coordinator follow-through; no Hub UUID is assigned by this source record.
+
+
+## T23 — Review native journal package assignment and storage integration boundaries
+
+```task
+id: NK-WP-0048-T23
+status: done
+priority: high
+state_hub_task_id: "6e7cd483-c7af-53a2-9d0a-3d76b6fb49ee"
+```
+
+Completed 2026-10-17: source/package placement and protected integration review
+only, separate from T21's completed PostgreSQL source and disposable-SQL proof.
+The owner review recommends a dedicated independently rolled-back
+`rapp-identity-provisioner`, owned by NetKingdom on rail-kubernetes, with a
+schema-valid draft declaration and no reef binding. No repository, registry
+entry, native package assignment or owner assent was created. Existing
+rapp-user-engine ownership/token delivery does not assign it the provisioner.
+
+The complete current rapp-postgres catalog has six declared consumers: four on
+platform-pg and two on platform-pg-2. The inert renderer-valid provisioner
+candidate fits platform-pg-2 at three of four, requesting one migration plus
+four runtime connections; placing it on the first cell is refused as a fifth.
+Normative package schema and full-catalog capacity/render checks passed. The
+four-consumer ceiling is estimated, not measured native headroom, and no current
+SQL session, backup or restore acceptance is claimed.
+
+The exact review identifies remaining package/substrate, SQL role/lease/TLS,
+network and backup/recovery contracts; independently authenticated protected
+scope callbacks; an external content-bound checkpoint holder with atomic
+advance/loss handling; and all-LDAP-writer exclusion or provider CAS/generation,
+including lifecycle cascades and remove/readd ABA. Generic Audit custody is not
+that checkpoint service. A database-only fence, final reread or one replica
+cannot exclude foreign directory writers. The native acceptance/recovery matrix
+keeps storage/lease admission separate from separately approved directory
+mutation; the production activation remains disabled pending trusted integration.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md`,
+source-validation.json and hash-bound source-references.json, plus the inert
+proposed declaration/consumer and renderer outputs. No native resource, lease,
+credential, deployment, destructive effect, independent holder or native owner
+acceptance was delivered. T14 retains these live gates with its original UUID
+and progress status. This completed review adds no duplicate T21 acceptance
+credit; publication, task UUID allocation and projection remain coordinator
+follow-through and no UUID is hand-assigned here.
+
+## T24 — Ensure-groups adapter source candidate
+
+```task
+id: NK-WP-0048-T24
+status: done
+priority: high
+state_hub_task_id: "1a3931ee-3b5f-52fc-9295-4073804f4bd2"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): ensure-groups-adapter.py, 8 tests (commit 5a2e7d6). Binds to the T14 PostgreSQL journal and refuses SQLite or a foreign binding. It accepts only canonical 1.1 cases, so T30 must add an explicit 1.2 path. It calls the provisioner's private `_group_binding`; a public helper is the cleaner shared edit.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind group creation to T14's journal/provenance seam; refuse without trusted journal callbacks.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. NetKingdom (directory) owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T25 — Mint-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T25
+status: done
+priority: high
+state_hub_task_id: "0de2a7d9-874d-578b-a076-f653fe42e30b"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): mint-secret-adapter.py, 9 tests (commit 558c5bc). Value-free receipts only. The receipt schema `railiance-platform.custody-mint.v1` and the mint/destroy capability interface are proposals that Platform must confirm.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned custody evidence seam: the adapter records value-free mint evidence only and never handles secret values.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T26 — Deliver-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T26
+status: done
+priority: high
+state_hub_task_id: "94b3cbf0-c908-5ac6-b0db-67385c3e021c"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): deliver-secret-adapter.py, 8 tests (commit 1b60f6e). The lane `platform-secret-delivery` and the schema `netkingdom.deliver-secret.v1` are proposals that Platform must confirm.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned delivery evidence seam (ESO/custody), value-free.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T27 — Bind-env adapter source candidate
+
+```task
+id: NK-WP-0048-T27
+status: done
+priority: high
+state_hub_task_id: "e56365f8-29b5-5c89-a329-8115f9f3b2a7"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): bind-env-adapter.py, 5 tests (commit 6fbce73). Binds references only. To fit the budget it does not yet wrap a full Warden `Adapter` like T13 (source-digest pin, authenticated evidence, parent-session revocation); it returns `(reference, run, rollback)`. That wrapping is a prerequisite for T30.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind the issuer Deployment env reference to the delivered secret reference, without values.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. NetKingdom runtime owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T28 — Deliver-consumer-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T28
+status: done
+priority: high
+state_hub_task_id: "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): deliver-consumer-secret-adapter.py, 5 tests (commit 650c1ac). Type 1.2 only. It assumes the owner has validated ESO TokenRequest and the controller-RBAC admission; that stays an owner gate.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Consumer-side delivery evidence seam, value-free.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform and Apps owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T29 — Hand-over adapter source candidate
+
+```task
+id: NK-WP-0048-T29
+status: done
+priority: high
+state_hub_task_id: "129db41d-4560-5e20-9f3b-c3c91e0a5601"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): handover-adapter.py, 8 tests (commit ec63539). The owner `apps` and lane `apps-consumer-handover` are proposals that the Apps owner must confirm. It has no reconcile path; restart handling follows T15.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Apps-owned consumer verification and hand-over receipt seam.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Apps owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T30 — Compose the descriptor set over the reviewed candidates
+
+```task
+id: NK-WP-0048-T30
+status: done
+depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29]
+priority: high
+state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
+```
+
+2026-10-17 done: coordinator review r3 (the-custodian `nk48-adapters-1.2-review/coordinator-review-r3.json`,
+fd07eaa) approved all nine files at ff8f597, with R2-F1..F3 resolved, an independent
+reconstruction of 117 passing and no open findings. This is a source review only:
+it grants no owner admission, pin or native authority. Owner review and admission
+continue under T16, which also takes the r2 observations, including the
+`warden_executes: false` steps that carry execution descriptors.
+
+2026-10-17 coordinator review r2 (the-custodian `nk48-adapters-1.2-review/coordinator-review-r2.json`)
+approved five files and rejected three, plus the artifact. The fixes are merged in
+2ee4ed0: R2-F1, mint-secret revokes the session and the broker grant
+independently (eeed8e1); R2-F2, deliver-secret binds to the admitted case and
+derives its Secret and custody path, with no caller reference (640292c); R2-F3,
+bind-env pins its five-file closure, and a new closure-completeness test checks
+every adapter (d16db30). Each regression test failed on 68f4bbb. The artifact is
+regenerated, and the full suite including kernel admission passed 117. Next is
+the r3 review. Open for owner review under T16: the type marks four steps
+`warden_executes: false`, yet each has an execution descriptor.
+
+2026-10-17 founder confirmed every proposed lane and schema name for T25-T29
+as-is. The artifact records them as `names_confirmed` (by founder, 2026-10-17),
+and no step is still `owner_confirmation_required`. Next: independent source
+review of the seven adapters.
+
+2026-10-17 founder decision (supersedes the `agent` decision below): the
+mint-secret actor is `human`. Coordinator review r1 (the-custodian
+`docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r1.json`,
+finding NK48-R1-F1) showed that unchanged kernel a45cf47 refuses every
+`effect: mint` admission whose actor is not `human` ("agent mint is
+forbidden"), so the `agent` descriptor could never be admitted. Adapter, tests
+and composer comment updated and the artifact regenerated (mint-secret
+descriptor digest now `sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9`);
+98 tests pass against a45cf47. The set needs an independent r2 review.
+
+2026-10-17 `test_admit_1_2_adapter_descriptors.py` runs Warden's own
+`Executor.admit` on all seven composed 1.2 descriptors, with the real 1.2
+type, the 1.2 forgejo example case, the reviewed `BrowserInputs` validator and
+fixture-only trust (stand-in adapters, nothing dispatched). It also pins that
+an agent mint descriptor is refused ("agent mint is forbidden") and that a
+wrong lane is refused for every step. Against the old `agent` revision
+(582ab9f) it fails as expected. Combined suite: 102 passed on ops-warden a45cf47
+and on current ops-warden. Fixture admission is not owner admission or a pin.
+
+2026-10-17 founder decision: the mint-secret actor is `agent`, not `warden`.
+The kernel is unchanged. The adapter, its test and the composer were updated and
+the artifact regenerated; all seven steps pass `Descriptor.decode` and
+`complete_executable_descriptor_set` is true (98 tests passed). The artifact
+stays `not_an_admission`, with no owner review, admission or dispatch permission.
+
+2026-10-17 composer merged (60b41a1 via 3c62bec) with follow-up 376b44b (merged;
+combined suite 98 passed). `compose-1.2-descriptors.py` loads 1.2 only through an
+explicit version root and refuses partial, duplicate, unknown or mismatched maps.
+`descriptor-composition-1.2.candidate.json` is a reviewable candidate, marked
+`not_an_admission`, with canonical 1.1 unchanged. ensure-groups and hand-over now
+carry and honour `parent-session` revocation, and the hand-over owner is
+parameterised (`railiance-apps` for Forgejo). Six of the seven steps pass
+`Descriptor.decode`. mint-secret is still refused: its actor `warden` is outside
+the kernel's human/agent set, and Platform (with ops-warden, if the kernel should
+change) must decide. Five steps carry `owner_confirmation_required` names. The
+set is complete only after both. Owner review, the canon section 6 successor
+revision and admission remain T16's.
+
+2026-10-17 prerequisites merged (65559ef; combined suite 78 passed):
+ensure-groups accepts 1.2 via an explicit `version_root='1.2'` (531151b), with
+1.1 still the default. bind-env is now a full Warden v1 `Adapter` (7442d21); its
+kernel-level fixture tests like T13's are still missing, and its `build()`
+signature changed. Composition is unblocked in source. Owner confirmation of
+the proposed step, lane and schema names remains before pinning.
+
+2026-10-17 inputs from T24–T29 that composition must resolve: T24 accepts
+only 1.1 while T28 accepts only 1.2, so add an explicit 1.2 ensure-groups path;
+T27 still needs full Warden `Adapter` wrapping; the lane, schema and owner names
+proposed in T25, T26 and T29 need owner confirmation before pinning.
+
+Split from T16 on 2026-10-17. Compose the seven-step source 1.2 descriptor set
+through the existing explicit version-root selection over T13 and T24–T29. No
+partial descriptor map, canonical 1.1 stays the default, and new descriptor bytes
+need a reviewed successor revision under canon section 6. Owner review and
+admission remain T16's.
+
+## T31 — Restart and lost-receipt fixtures against Warden's original-intent interface
+
+```task
+id: NK-WP-0048-T31
+status: done
+priority: high
+state_hub_task_id: "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): test_registration_original_intent_reconcile.py, 8 tests (commit 74adcd7), runs against the unmodified ops-warden a45cf47. The holder is a test-only in-memory store. For real T15 support the T13 adapter's `build()` needs an injected holder/readback capability, a `reconcile_original` callback, and a `verify` that accepts reconcile results. Rollback after restart stays refused until there is an owner contract.
+
+Split from T15 on 2026-10-17. ops-warden published the original-intent
+lookup/context interface in `src/warden/case_run.py` (`OriginalIntent`,
+`Journal.original_intent`, `Adapter.reconcile_original`; commit `a45cf47`).
+Build T15's restart/lost-receipt fixtures for the registration adapter against
+it: the original intent is kept separate from the reconcile attempt; wrong
+attempt/case/source/principal and unavailable-holder cases refuse; and a missing
+or ambiguous record stays uncertain, with no add replay or undo. The interface
+is Warden's own dispatch record, not owner-authenticated created-only provenance.
+Selecting the actual authenticated holder stays a T15 owner gate.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.patch b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.patch
new file mode 100644
index 00000000..4b5b3752
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/candidate.patch
@@ -0,0 +1,56 @@
+--- a/workplans/NK-WP-0048-security-case-types.md
++++ b/workplans/NK-WP-0048-security-case-types.md
+@@ -783,13 +783,15 @@
+ Owner: NetKingdom for registration state, with Warden owning kernel evidence
+ admission. T22 records the completed source review and exact existing-seam gaps;
+ T15 retains implementation and authenticated restart/lost-receipt acceptance.
+-Next action: identify the actual owner publisher/authenticator and bounded
+-original-attempt readback contract, and obtain Warden's reviewed original-intent
+-lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
+-retains attempt identity in historical rows but only hashes evidence references;
+-load drops that context and reconcile passes a fresh attempt to the callback.
+-The adapter's original payload and creation record remain process-local. Neither
+-that journal nor a current matching registry entry reconstructs creation authority.
++Next action: select and admit the actual owner publisher/authenticator and bounded
++original-attempt readback contract for the merged holder/observe adapter seam.
++Warden's original-intent persistence/interface (`a45cf475`) and additive validation
++(`117fec9241e7b985dfb187b992e173d0a5dc3700`) are now published and projected.
++The local Journal retains admitted nonsecret original context, validates original
++actor/attempt and metadata linkage to the original running receipt, and supplies
++it separately from the new reconciliation attempt. This local consistency is not
++independent original-holder authorization or creation provenance; neither the
++journal nor a current matching registry entry reconstructs creation authority.
+ 
+ The owner contract must bind the original Invocation, case/type/descriptor/catalog/
+ acceptance pins, source, principal and admitted tenant/realm provenance, separately
+@@ -804,9 +806,10 @@
+ contract: independently authenticated original created-only provenance, original
+ exact client entry and unchanged current postcreation UID/resourceVersion before
+ any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
+-The T13 adapter deliberately refuses post-restart rollback and installs no
+-reconciliation callback. Existing source review, JSON receipts and synthetic
+-trust do not satisfy native holder acceptance or authorize attended recovery.
++The merged T13 adapter exposes reconciliation only through paired injected
++holder/observe capabilities and still refuses post-restart rollback. Existing
++source review, JSON receipts and synthetic trust do not satisfy independent
++holder authorization/provenance or native admission, or authorize attended recovery.
+ Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
+ 
+ 2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
+@@ -816,6 +819,16 @@
+ T16's decomposition under the same token budget. Remains todo, gated on Warden
+ publishing the reviewed lookup/context interface and on owner selection of the
+ authenticated original-attempt holder.
++
++2026-10-17 current-source correction: the earlier same-day `d97652a` lookup
++checkpoint and T31 adapter-next-action note above are historical and superseded
++by the published Warden interface/validation and merged `061461e` adapter seam.
++The 54 focused Warden checks establish source behavior only. Current admission
++leaves tenant/realm empty; no admitted tenant/realm provenance is inferred.
++T15 remains wait for actual independently authenticated owner-holder/readback
++selection, independent review of the changed adapter, and native restart/lost-
++receipt acceptance. Existing task metadata, owner gates and historical reviews
++are unchanged.
+ 
+ ## T16 — Select and review the actual machine descriptor composition
+ 
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/key39-readonly-crosscheck.json b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/key39-readonly-crosscheck.json
new file mode 100644
index 00000000..df3b9ab0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/key39-readonly-crosscheck.json
@@ -0,0 +1,108 @@
+{
+  "scope": "Read-only bounded current NetKingdom docs/evidence, docs/reviews and history public Markdown/JSON/YAML search; current KEY39 workplan and existing assessment/standing rule read",
+  "netkingdom_head": "001a38ca2aa85155ce4840c4da22aca6e2346171",
+  "matching_files": [
+    {
+      "path": "docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json",
+      "sha256": "d6a1a575e2690a242db76d6d5de60f48648211f2cf62c156f22486e1e0bbf28d",
+      "classification": "source-inventory only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json",
+      "sha256": "f7293bc3cc896e23840d767bf86bd379f202a665f6a334485081831ad067d262",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-lifecycle-v3-netkingdom-review.json",
+      "sha256": "06ac6616e75eb7690836fbce94b30ebecd3a674a3b256118d180ed13c90db3b1",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-lifecycle-v4-netkingdom-review.json",
+      "sha256": "4f4498203a31bd46dbc3715c0df1cbb9eee63bed5b2c1baf430ff3c4a37c13cb",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-lifecycle-v5-netkingdom-review.json",
+      "sha256": "32a62bd1ca1bd7311965d016d4d6a6e4d9177f3423c63add436d9d309865eacc",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-private-producer-net-review.json",
+      "sha256": "a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-producer-v3-net-refusal.json",
+      "sha256": "38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-producer-v4-net-review.json",
+      "sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-ready-v9-net-review.json",
+      "sha256": "245edc962bbc5bef459d0194c9d0fa916417e327637407470bb6e7cbb1ca5ae9",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-v6-net-source-review.json",
+      "sha256": "d011b8945dab70b4d7965baea826b8983993e8b8c04ca72d43f52b7c039e84ce",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-v7-net-source-review.json",
+      "sha256": "a0c65c6655e3152f209ad83dc69ecba0dcba10e21f723fba4ab3a58501f358ff",
+      "classification": "source review only"
+    },
+    {
+      "path": "docs/reviews/2026-10-11-key39-v8-net-source-review.json",
+      "sha256": "b2711c8ff72724751f9c10ce199fa3564b7893aa4c0377df0d3d1611d0a97eda",
+      "classification": "source review only"
+    }
+  ],
+  "actual_native_negative_and_cleanup_receipt_found": false,
+  "interpretation": "No such receipt found in searched source; no conclusion about external or live evidence absence. Other identity/backup/issuer cleanup receipts are not KEY39 OpenBao wrong-claim/native probe acceptance.",
+  "latest_ready_v9": {
+    "native_readiness": false,
+    "KEY39_task_closure": false,
+    "synthetic_offline_only": true
+  },
+  "existing_authority": {
+    "source_design_accepted": true,
+    "registration_go": "caafe4be-4f68-47b4-9567-316d47b94992 already resolved",
+    "standing_attended_rule_preserved": true,
+    "no_renewed_source_or_registration_approval_needed": true,
+    "no_expansion_to_credential_or_native_action": true
+  },
+  "current_tasks": {
+    "KEY-WP-0039-T01": "done",
+    "KEY-WP-0039-T02": "wait",
+    "KEY-WP-0039-T03": "done"
+  },
+  "actual_acceptance_still_needed": "Existing attended every-case refusal, value-free committed native result, revoke/baseline restoration and exact probe-client cleanup; existing KEY38 registration/claims and owner custody/readiness/role/route returns preserved. No new protocol/framework or additional closure conditions.",
+  "additional_source_refs": [
+    {
+      "repo": "key-cape",
+      "path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
+      "head": "e76d4130f31a02554048f30bf838043cea7a5b80",
+      "sha256": "7b4b97f9a9e6b8291078e187b967a5356702dd7817880f92c12649d764e5e0ae"
+    },
+    {
+      "repo": "the-custodian",
+      "path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md",
+      "head": "08870d65de615cbb8b5e1f374bf53a2229c21930",
+      "sha256": "6fa24e6dab7a26356caaba07bb539538e22a0b9af2dd19c765b6007978ae8bcd"
+    },
+    {
+      "repo": "the-custodian",
+      "path": "docs/decisions/2026-10-11-security-unblock-decisions.md",
+      "head": "08870d65de615cbb8b5e1f374bf53a2229c21930",
+      "sha256": "660b7a3d008cd6000bbefa55ef692bb5879e067aa086f01effd249f68a382209"
+    }
+  ],
+  "native_actions": false,
+  "credential_access": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/manifest.json
new file mode 100644
index 00000000..70fe25cf
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/manifest.json
@@ -0,0 +1,49 @@
+{
+  "status": "prepared-unapplied",
+  "source_refs": [
+    {
+      "repo": "net-kingdom",
+      "path": "workplans/NK-WP-0048-security-case-types.md",
+      "head": "001a38ca2aa85155ce4840c4da22aca6e2346171",
+      "sha256": "b682cd607d9ed9b232656cc7934ec09ac4e986c1c81131a44f80240342a0571c"
+    },
+    {
+      "repo": "ops-warden",
+      "path": "src/warden/case_run.py",
+      "head": "117fec9241e7b985dfb187b992e173d0a5dc3700",
+      "sha256": "77e8117a1fb4e039815b555797778f7180f11e30f64cebe51b350b3eb7e46768"
+    },
+    {
+      "repo": "ops-warden",
+      "path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
+      "head": "117fec9241e7b985dfb187b992e173d0a5dc3700",
+      "sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088"
+    }
+  ],
+  "candidate_sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b",
+  "all_task_blocks_unchanged": true,
+  "historical_checkpoints_preserved": true,
+  "knowledge": {
+    "version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "start": "withheld; actual owner source reviewed"
+  },
+  "files": [
+    {
+      "path": "candidate.md",
+      "sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b"
+    },
+    {
+      "path": "candidate.patch",
+      "sha256": "4402448cac9b50b745f247aec1c550a5fc3532e702ad4ceeae0812691278118c"
+    },
+    {
+      "path": "key39-readonly-crosscheck.json",
+      "sha256": "c62bb32f43954b46ca2fa904874f9041c95bef7fdf00cd7e4c02f34f0570a57a"
+    },
+    {
+      "path": "preimage.md",
+      "sha256": "b682cd607d9ed9b232656cc7934ec09ac4e986c1c81131a44f80240342a0571c"
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/preimage.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/preimage.md
new file mode 100644
index 00000000..71cba31e
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-current-narrative-r1/preimage.md
@@ -0,0 +1,1506 @@
+---
+id: NK-WP-0048
+type: workplan
+title: "Establish SecurityCaseTypes so that known security cases are light"
+domain: infotech
+repo: net-kingdom
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-08"
+updated: "2026-10-17"
+depends_on: []
+related_repos:
+  - ops-mason
+  - ops-warden
+  - key-cape
+  - railiance-platform
+  - informed-decision
+state_hub_workstream_id: "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb"
+---
+
+# NK-WP-0048 - Establish SecurityCaseTypes so that known security cases are light
+
+## Why
+
+The founder's direction (2026-10-08): setting up a security integration of a
+kind that has been done before should be easy, meaning accept the case, then
+ops-mason arranges it and ops-warden follows through. Setting up a new kind
+needs ample documentation and tests and an informed-decision, because its shape
+is part of the security architecture.
+
+Today every integration is hand-built: per-client helper scripts, per-lane
+custody, founder checklists. The trigger was KEY-WP-0038 (Forgejo as an OIDC
+client), whose next step was going to be yet another hand-written rollout
+script.
+
+This plan continues the pattern work of NK-WP-0008 (pattern infospace),
+NK-WP-0009 (tutorials) and NK-WP-0030 (scenario composition). It turns patterns
+into **SecurityCaseTypes** that ops-mason and ops-warden can execute. Canon:
+`canon/standards/security-case-types_v0.1.md` (proposed).
+
+Companion plans: ops-mason `MASON-WP-0010` (materialization) and ops-warden
+`WARDEN-WP-0044` (follow-through).
+
+## Tasks
+
+```task
+id: NK-WP-0048-T01
+status: done
+priority: high
+state_hub_task_id: "930ac3e9-20ec-5473-98cd-3fe8fddb730f"
+```
+
+### T01 — Accept the terminology and the canon
+
+Founder review of `canon/standards/security-case-types_v0.1.md`, including its
+section 10 open questions. On acceptance the canon status goes from `proposed`
+to `accepted`.
+
+2026-10-08: accepted by the founder (in session). Canon status `accepted`;
+section 10's open questions are carried forward to the first type (T04, T05).
+
+```task
+id: NK-WP-0048-T02
+status: done
+priority: high
+state_hub_task_id: "19c25d96-a55c-58f0-9168-3fdbc4955fc2"
+```
+
+### T02 — Inventory the de-facto types already built by hand
+
+Read-only. List every security integration built so far and group them by shape.
+Known starting points:
+
+- browser OIDC relying parties on key-cape: informed-decision-approver,
+  coulomb-social, user-engine portal, openbao-admin, and Forgejo (pending)
+- confidential service clients with `client_credentials`: secrets-engine
+  approval, requester and openbao clients, approval-engine operator
+- workload KV read lanes on OpenBao: the railiance-platform credential lane
+  designs and CCRs, for example `railiance-backup-offsite-lane`
+- short-lived SSH certificates through ops-warden (`warden sign`)
+- tunnelled operator access (ops-bridge)
+
+For each: the repositories involved, the hand-built steps, attended human steps,
+custody paths, verification evidence, and rollback (if any). Output
+`docs/security-case-type-inventory.md`, ranking candidate types by how often the
+shape recurs and how much manual work each instance costs today.
+
+2026-10-08: done, `docs/security-case-type-inventory.md`. 36 of 37 CCRs are
+already `request_type: workload-kv-read`, a de-facto type reviewed each time as
+if it were new. Browser clients: 5 hand-built plus Forgejo, each with its own
+rollout script. Confidential service clients need a registration plus two or
+three KV-read CCRs each. A forge read identity is needed in bulk by
+ORGREF-WP-0002-T06. Recommendation: oidc-browser-relying-party first (unblocks
+the forge), workload-kv-read second (largest payoff), then forge-read-identity.
+
+```task
+id: NK-WP-0048-T03
+status: done
+depends_on: [NK-WP-0048-T01]
+priority: high
+state_hub_task_id: "e487975b-73b1-516c-971d-da4cbbb93063"
+```
+
+### T03 — Schema, template and validator
+
+- `canon/schemas/security-case-type_v0.1.schema.json` and
+  `security-case_v0.1.schema.json`
+- `security-case-types/_template/` with `type.yaml`, `README.md` and tests to copy
+- a validator, extending `tools/security-scenario-composer/`, that checks a type,
+  checks a case against its type, and renders the case into the composer's
+  deterministic plan (still `execution.permitted: false`)
+
+Acceptance: the validator rejects missing sections, secret-shaped parameter
+values, unpinned providers and cases against non-`implemented` types, with tests
+for each.
+
+2026-10-08: done. `canon/schemas/security-case-type_v0.1.schema.json` and
+`security-case_v0.1.schema.json`; `tools/security-case-types/security_case_validator.py`
+(`validate-type`, `validate-case`, `render`, reusing the scenario composer);
+`security-case-types/_template/` (a valid, runnable example type over
+`net-kingdom.local-identity`, with README sections, an example case and tests that
+travel with every copy). 31 tests pass, including the composer's existing suite.
+
+```task
+id: NK-WP-0048-T04
+status: done
+depends_on: [NK-WP-0048-T02, NK-WP-0048-T03]
+priority: high
+state_hub_task_id: "2fffe112-7d55-5680-9952-78d74f44f87f"
+```
+
+### T04 — Define the first type: browser OIDC relying party
+
+`security-case-types/oidc-browser-relying-party/`, version 1.0:
+
+- parameters: client id, display name, exact redirect URIs, scopes, client type
+  (confidential or public), MFA pin, the groups the consuming service maps,
+  custody path for the secret (confidential only), consuming service and its
+  owner
+- composition: key-cape client registration (key-cape declares it as a playbook
+  capability), secret minting into custody (railiance-platform), LLDAP group
+  existence and membership (net-kingdom identity-provisioner), handover to the
+  consuming service
+- materialization (ops-mason) and follow-through (ops-warden) sections
+- verification: discovery lists the redirect URI; a test sign-in returns the
+  expected claims for one human; anonymous access to the custody path is denied
+- rollback: remove exactly this client and its custody path
+- README: threat model, MFA rationale, why redirect URIs are exact, which steps
+  still need an attended login and how that is minimised
+- reference instances: informed-decision-approver, coulomb-social, user-engine
+  portal, openbao-admin
+
+Acceptance: complete per canon section 3, tests green, status `proposed`.
+
+2026-10-08: done. `security-case-types/oidc-browser-relying-party/` 1.0 (proposed):
+`type.yaml` with 12 parameters (the custody reference is required only for
+confidential clients), composition over key-cape's new
+`key-cape.oidc-client-registration` declaration (contract PASS, `maturity:
+planned`), materialization and follow-through, verification and rollback, all
+conditional on client type where it matters. One attended step,
+`register-client`, justified by the live registry being a Kubernetes Secret.
+README with threat model, alternatives, an honest fit table (portal and vergabe
+fit; Forgejo is the first confidential case; openbao-admin, coulomb.social and
+informed-decision-approver do not fit 1.0), and known limits. Examples: Forgejo
+(checked against the accepted request) and a public portal. The validator gained
+`when` / `required_when` conditions and provider discovery. 43 tests pass.
+ops-mason's and ops-warden's sections are drafted in the type. Their owners
+review them in MASON-WP-0010-T01 and WARDEN-WP-0044-T01 before acknowledgment
+(T05).
+
+```task
+id: NK-WP-0048-T05
+status: done
+depends_on: [NK-WP-0048-T04, MASON-WP-0010-T01, WARDEN-WP-0044-T01]
+priority: high
+state_hub_task_id: "3d987d3d-0797-538b-86e4-51185a327ae2"
+```
+
+### T05 — Acknowledge the type through informed-decision
+
+Prepare the Decision Memo from the type's README and `type.yaml` and submit it
+through informed-decision's production intake. On acknowledgment the type
+moves to `acknowledged`.
+
+2026-10-08: Decision Memo prepared. Hub decision `e418263e-a71f-4f01-a970-c87c9e187c09`.
+`security-case-types/oidc-browser-relying-party/decision/`: `packet.md` (question,
+one act, what acknowledging does not do, the shape, alternatives, attended
+steps, limits, evidence), `build_intake.py` and the built `intake.json` (memo
+class `decision-record`, review group `net-kingdom-admins`, resolves the hub
+decision on answer). The envelope passes informed-decision's own
+`validate_submission`. Queuing it is an attended operator step, a write inside
+the production dispatcher pod:
+
+    kubectl -n state-hub exec -i deploy/state-hub-memo-dispatch -- \
+      python -m api.services.memo_dispatch --queue /data/private enqueue --envelope /dev/stdin \
+      < security-case-types/oidc-browser-relying-party/decision/intake.json
+
+The answer then appears for review in informed-decision.
+
+2026-10-08: queued by the founder (`pending`, `queued`) after one refusal: the
+first envelope's idempotency key was not State Hub's stable
+`state-hub.<decision>.<memo>` form, and the builder now validates against both
+sides. The dispatcher delivered it to informed-decision (ledger 7 → 8
+delivered). T05 waits for the founder's answer in informed-decision, which
+resolves hub decision `e418263e`.
+
+2026-10-08: ops-mason's review (MASON-WP-0010-T01) folded into the type, still
+1.0 `proposed`: `secret_ref` is no longer a parameter, the type derives
+`platform/workloads/keycape/{client_id}`; policies are
+`workload-kv-read-keycape-{client_id}-eso` and
+`workload-kv-read-keycape-{client_id}-{consuming_service}`, each with a templated
+body (`read` on that one data path); new `openbao_role`
+`external-secrets-keycape-{client_id}` (Kubernetes auth, ESO service account,
+15m, no default policy); catalog entry `{consuming_service}-keycape-client`;
+the two rollback steps on the KV path collapse into one metadata delete. The
+schema and validator now require a `body` on policy and role items. 105 tests
+pass. Two consequences: the delivered memo describes the type before these
+changes (a case-set custody reference, two differently named policies, no ESO
+role), so the founder answers on a superseded shape unless the memo is
+re-sent; and Forgejo's custody path moves from the accepted request's proposed
+`platform/workloads/forgejo/netkingdom-oidc-client` to
+`platform/workloads/keycape/forgejo`, which key-cape (KEY-WP-0038) and
+railiance-apps (RAPPS-WP-0016-T02) need to adopt in T06. ops-warden's review
+(WARDEN-WP-0044-T01) is still in progress.
+
+2026-10-08: revised memo `nk-wp-0048-t05-oidc-browser-relying-party-r2` built
+(`packet.md`, `intake.json`, packet `sha256:af6435e2…`); it states that it
+supersedes the first memo and passes informed-decision's and the dispatcher's
+validation. It needs a new memo id because the dispatcher refuses new content
+under a delivered idempotency key (`idempotency_conflict`). Queuing it is the
+same attended step as above. Both memos serve hub decision `e418263e`; the
+first answer resolves it, so the first memo must not stay open: an accept on it
+would acknowledge the superseded shape, and a decline would resolve the
+decision against r2. Close it with `return` (a reviewer verb that requests a
+new revision and does not resolve the hub decision; only accept and decline
+do), commenting that r2 supersedes it, then answer r2. `withdraw` exists in
+the vocabulary but is not offered to reviewers, and lifecycle `revise` only
+applies to lifecycle-registered memos, not intake-delivered ones.
+
+2026-10-09: the founder reports r2 enqueued and the first memo returned. At
+close, hub decision `e418263e` still showed `open` (not verified whether r2
+was answered or the answer is still in transit; the dispatcher ledger was not
+read). ops-warden's review (WARDEN-WP-0044-T01, ops-warden
+`history/2026-10-08-oidc-rp-follow-through-review.md`, d470f2e) arrived at
+21:25, before r2 was built, and is not in r2. Required before WARDEN-WP-0044-T02:
+R1 a per-step `lane` (missing: identity-provisioner caller credential,
+railiance-platform broker grant), R2 canon meaning of `warden_executes: true`
+(caller proxy, caller identity, no standing ops-warden token; ADR-0002), R3 a
+per-step `value_handling`. Refinements R4 (one type-level catalog lane instead
+of a per-case entry, which conflicts with ops-mason's item 5), R5 (ESO Ready gate
+before bind-env), R6 (exact accepted memberships), R7 (mfa-pinned and
+secret-delivered checks). Next: if r2 was accepted, fold R1-R3 and R5-R7 in as
+a follow-up and settle R4 between ops-warden and ops-mason before T06; if not,
+hold r2, fold them in and build r3.
+ key-cape and railiance-apps were told about Forgejo's new custody
+path.
+
+2026-10-09: r2 was not answered (hub decision `e418263e` open; dispatcher 9
+delivered), so r2 is held and r3 replaces it. ops-warden withdrew R4 for R4′
+(message a66a9204): one catalog entry per case with its body templated in the
+type. Folded in:
+
+- Canon section 3: a narrow meaning of `warden_executes: true` (caller proxy,
+  caller identity, no standing credential; ops-warden ADR-0002), plus per-step
+  `lane`, `value_handling` and an optional `ready_check`. A catalog entry body is
+  now required, like policy and role bodies.
+- Schema and validator enforce all of these.
+- The type: lanes `identity-provisioner-groups` and
+  `keycape-client-secret-generate` (both new) and `key-cape-oidc-login`;
+  `mint-secret` is `generated_in_custody`; a Ready gate on `deliver-secret`;
+  `ensure-groups` adds exactly the accepted case's memberships; new checks
+  `secret-delivered` and `mfa-pinned`; the catalog-entry body follows R4′.
+- 110 tests pass.
+
+Memo r3 (`nk-wp-0048-t05-oidc-browser-relying-party-r3`, packet
+`sha256:726dfc01…`) passes informed-decision's and the dispatcher's validation.
+The founder queues it with the same command, returns r2 with a comment that r3
+supersedes it, then answers r3.
+
+Prerequisites for T06, not for T05:
+- the two new lanes, each through its owner;
+- a founder-approved rollout of an identity-provisioner image containing
+  630ebfd (the deployed one is main-6c4fcaf from 2026-09-24, without
+  `/v1/groups/ensure`).
+
+ops-mason's request to create LLDAP group `fluid-telegram-operators` (message
+259ec26d) was answered: not possible from here by that path; the founder creates
+it in the LLDAP admin UI.
+
+2026-10-09: ops-warden finished its side of WARDEN-WP-0044-T01 (message
+`58d33f40`, commit 0e7ceb8): the revised type conforms to `warden case
+check-type`, with no further changes asked of the type. This acknowledges that
+review. Its later addendum R8 (message `af274783`, ops-warden
+`history/2026-10-08-oidc-rp-follow-through-review.md`) showed that lane
+`identity-provisioner-groups` cannot exist as declared: the provisioner's only
+HTTP credential is user-engine's runtime token, and its NetworkPolicy admits
+only user-engine pods, so a caller-proxy lane would act as user-engine. Taken
+option 1 (ops-warden's recommendation): `ensure-groups` and its rollback are
+attended, in the `register-client` session on `key-cape-oidc-login`, run inside
+the provisioner pod; no token is read. Option 2 (an operator credential of its
+own on the provisioner) stays open for a later version. `warden case
+check-type` now reports only `keycape-client-secret-generate`
+(railiance-platform) as missing. 89 tests pass.
+
+Hub decision `e418263e` was still open, so memo r4
+(`nk-wp-0048-t05-oidc-browser-relying-party-r4`, packet `sha256:452ea421…`)
+replaces r3; it passes informed-decision's and the dispatcher's validation. The
+founder queues it with the same command, returns r2/r3 if still open with a
+comment that r4 supersedes them, then answers r4.
+
+Prerequisites for T06 are now: lane `keycape-client-secret-generate`
+(railiance-platform), and a founder-approved rollout of an identity-provisioner
+image containing 630ebfd.
+
+2026-10-09: done. The founder queued r4 (`pending`, `queued`), returned r3 as
+superseded and accepted r4 in informed-decision. informed-decision's hub
+write-back is off in production (`INFD_HUB_WRITEBACK` unset), so net-kingdom
+resolved hub decision `e418263e` from the founder's report, naming memo r4 in
+the rationale. The type is `acknowledged`; it becomes `implemented` with T06.
+
+```task
+id: NK-WP-0048-T06
+status: wait
+depends_on: [NK-WP-0048-T05, NK-WP-0048-T08, NK-WP-0048-T09, NK-WP-0048-T12, NK-WP-0048-T13, NK-WP-0048-T14, NK-WP-0048-T15, NK-WP-0048-T16, NK-WP-0048-T17, NK-WP-0048-T18, NK-WP-0048-T20, MASON-WP-0010-T03, WARDEN-WP-0044-T03]
+blocking_reason: "Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status."
+priority: high
+state_hub_task_id: "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
+```
+
+### T06 — First KnownSecurityCase: Forgejo
+
+Write `security-cases/forgejo-netkingdom-oidc.yaml` from the parameters the
+founder accepted in KEY-WP-0038-T01 (`key-cape/docs/forgejo-oidc-client-request.yaml`),
+so that acceptance carries over as the case acceptance. ops-mason materializes it;
+ops-warden follows through and verifies it. The type becomes `implemented` once
+this reference case is live.
+
+This replaces the hand-built path proposed for KEY-WP-0038-T02.
+
+2026-10-09: case written, `security-cases/forgejo-netkingdom-oidc.yaml`, status
+`accepted`: the example's parameters plus the founder's 2026-10-08 acceptance of
+the key-cape request (owner and founder), with the custody-path derivation
+covered by the type's acknowledgment (memo r4). It validates and renders (plan
+`execution.permitted: false`; three attended steps on `key-cape-oidc-login`);
+it needs `--allow-unimplemented` until it is live, since it is the case that
+makes the type `implemented`. A test keeps it equal to the type's example.
+Still open before it runs: ops-mason renders and builds it (MASON-WP-0010-T02,
+T03, unblocked by T05), ops-warden plans and runs it (WARDEN-WP-0044-T02, T03),
+railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason
+`789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved
+identity-provisioner rollout containing 630ebfd.
+
+2026-10-09: identity-provisioner rolled out, founder-approved in session:
+`main-630ebfd` (`sha256:bafb4860…`, built by the image workflow) replaces
+`main-6c4fcaf` (`sha256:ffacd5d7…`; only change: 630ebfd, additive). Applied
+with `kubectl set image` on the Deployment only (generation 17 → 18, 1/1 Ready);
+the file's Service, NetworkPolicies and Ingress were not reapplied. Verified in
+the pod: `ensure_service_groups` and `revoke_service_groups` present, `/readyz`
+200; no token used, no group changed. Rollback: `kubectl -n sso set image
+deploy/identity-provisioner provisioner=forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2`.
+The pin in `sso-mfa/k8s/identity-provisioner/deployment.yaml` follows.
+
+2026-10-09: ops-warden closed WARDEN-WP-0044-T01 and shipped `warden case plan`
+(T02, message `06303d1d`); the accepted Forgejo case is refused until ops-mason
+materializes it, and a materialized copy plans cleanly once
+`keycape-client-secret-generate` exists. Its observation that `bind-env` carries
+a literal `KEYCAPE_<CLIENT_ID>_CLIENT_SECRET`: the validator now renders a
+`{param:env}` format spec (upper case, `-` as `_`, as `keycape-client.py`
+derives the name) and rejects unknown specs, and follow-through and rollback
+text is now checked for unknown placeholders too (patch-level, canon section 6).
+The type keeps the literal until ops-warden's planner (`text.format`) renders the
+spec as well; asked of ops-warden. 53 tests pass.
+
+2026-10-10: ops-warden rendered `{param:env}` in `warden case plan`
+(23ba584, message `c1df14b7`; other specs and `!conversion` refused). The type
+adopts it as a 1.0 patch (canon section 6): `bind-env` and its rollback now read
+`KEYCAPE_{client_id:env}_CLIENT_SECRET`. ops-mason reports the Forgejo case
+rendered and built (message `1ebddae9`; CCR drafts handed to railiance-platform),
+so T06 now waits on the platform apply, the mint-secret lane and the attended
+register-client session.
+
+2026-10-10: key-cape adopted the type's custody path (key-cape ab5cccd, message
+`88a4559c`): `docs/forgejo-oidc-client-request.yaml` and KEY-WP-0038-T02 name
+`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, delivered as
+`sso/keycape-forgejo-client` through `external-secrets-keycape-forgejo`, and the
+`forgejo/netkingdom-oidc-client` proposal is withdrawn. This matches the type and
+the Forgejo example; no change needed here.
+
+2026-10-10: key-cape's type-composition review (key-cape 6038483, message
+`8e5ed5f6`) found the composition sound with two blocking findings, taken as a
+1.0 patch (stricter validation and documentation, canon section 6):
+R1, redirect URIs now refuse `?` and `#` in the type pattern and in
+`keycape-client.py`'s `REDIRECT` (KeyCape refuses `?` at startup and the single
+replica would stop); R2, `allowed_scopes` always includes `groups`, the renderer
+refuses `access_groups` without it, and `access_groups` now says the consumer
+enforces the gate because KeyCape has none; R3, `mfa_required` "false" means the
+per-user privacyIDEA policy; R4, register-client's justification records the
+restart for every client, the quiet window, and that the rendered registry must
+pass KeyCape's client validation before it. The accepted Forgejo case and both
+examples still validate; 116 tests pass.
+Open, needs a decision: R2's verification step that the consumer enforces the
+group gate is a new verification step, hence 1.1 (minor), and the validator pins
+cases to the exact type version, so the accepted 1.0 Forgejo case would need
+re-pinning. Also open with key-cape: a KeyCape entry point that validates a
+rendered client registry without starting the server; until then
+`keycape-client.py` mirrors the redirect rule.
+
+2026-10-10: founder go for 1.1, so no 1.0 run overlaps. The type adds
+verification `consumer-enforces-groups`, and hand-over now requires the consumer
+to enforce `access_groups` (minor, canon section 6; risk class unchanged, no new
+acknowledgment; history in the type README). The accepted Forgejo case and both
+examples are re-pinned to `oidc-browser-relying-party@1.1` before any apply; the
+acknowledgment intake keeps `@1.0` as the record of what was acknowledged.
+ops-mason's build and ops-warden's case-ref digest predate this and need a
+re-render.
+
+2026-10-10: ops-mason re-rendered the Forgejo case from `@1.1` (message
+`22c6bba6`; plan digest `af1f4f81…`, no collisions) and rebuilt the bundle. The
+rendered OpenBao objects are identical to 1.0, so the already applied
+CCR-2026-0041 stands; 1.1 changes only consumer-side steps. key-cape shipped
+`keycape check-config` (c528daa, message `a7b0aeff`): KeyCape's startup checks
+without secret values, including the new duplicate-clientId rule.
+`keycape-client.py --check-config <binary>` now runs it on the live and the
+proposed registry, fed on stdin, and apply refuses a proposed registry that
+fails; register-client's entry point names the option (1.1 patch). The deployed
+image predates c528daa, so the binary is built from key-cape source for now.
+Before the next KeyCape rollout (Forgejo register-client or the CCR-2026-0018
+window), the attended operator runs `inspect --check-config` so the live
+registry is checked too.
+
+```task
+id: NK-WP-0048-T07
+status: wait
+depends_on: [NK-WP-0048-T06]
+blocking_reason: "The next types follow once the first one is proven end to end."
+priority: medium
+state_hub_task_id: "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7"
+```
+
+### T07 — Queue the next types
+
+From the T02 ranking, open the next type drafts (likely the confidential service
+client and the workload KV read lane), each to be acknowledged on its own.
+Record which existing hand-built instances get adopted as cases, without
+rewriting them in place.
+
+```task
+id: NK-WP-0048-T08
+status: done
+priority: high
+state_hub_task_id: "8e519082-dc8b-5e46-b660-03d03e55dcf6"
+```
+
+### T08 — identity-provisioner: ensure service-access groups
+
+The type's `ensure-groups` step calls `identity-provisioner groups ensure --groups
+<list> --members <group=user+user;...>`. The provisioner already has idempotent
+`_ensure_group` and `_add_group`, but exposes only tenant-scoped operations. Add
+the general operation (create if absent, add the listed memberships, never
+remove others), its rollback (remove only this case's memberships), tests, and
+the ops-warden route for its service identity.
+
+2026-10-08: done. `identity-provisioner/provisioner.py` gained
+`ensure_service_groups` (`POST /v1/groups/ensure`) and `revoke_service_groups`
+(`POST /v1/groups/revoke`), behind the existing service-token check. Names
+matching `tenant*`, `netkingdom-*` and `lldap_*` are reserved; members must
+already exist; everything is validated before any change; memberships are read
+back before success; nothing else is ever removed; groups are deleted only when
+asked and empty. 7 new tests (39 in the provisioner suite). The type's
+`ensure-groups` step and its rollback now name these endpoints. The ops-warden
+route for the provisioner's service token belongs to WARDEN-WP-0044-T01.
+
+```task
+id: NK-WP-0048-T09
+status: done
+priority: high
+state_hub_task_id: "0ee12dfc-8260-5038-bd39-cc7fb4113be0"
+```
+
+### T09 — The `keycape-client` entry point and its declaration
+
+Planned first as key-cape KEY-WP-0038-T04. Moved here because the machinery a
+live registration needs already lives in net-kingdom, where KeyCape is deployed
+(`sso-mfa/k8s/keycape/`): the contained kubectl, the cluster-identity pin and the
+issuer pin. A copy in key-cape would drift.
+
+2026-10-08: done. `sso-mfa/k8s/keycape/keycape-client.py` derives the KeyCape
+client record from a case (`client-from-case`). It adds or removes exactly one
+client with the existing safeguards (byte-preserving merge, exact match or
+refuse, shared-reference refusal, compare-and-swap, read-back, contained errors),
+requires the Deployment env binding first for confidential clients, and requires
+the case acceptance record for `apply` instead of a per-client founder decision
+id. 15 tests, including a regression showing that the vergabe case reproduces
+its hand-built registration exactly; all 71 helper tests pass. Declaration
+`capabilities/playbooks/net-kingdom.keycape-client-registration.yaml` (contract
+PASS, `maturity: implemented`) replaces key-cape's draft. The type now pins it,
+and for confidential clients adds `deliver-secret` (delivery from custody into
+the sso namespace) and `bind-env` (Deployment env), attended in the same session
+as `register-client`. The per-client helpers stay until their clients are
+adopted as cases.
+
+2026-10-10 — NetKingdom owner review of the execution seam, source only:
+ops-warden/docs/security-case-execution-proposal.md SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+was reviewed against INTENT, SecurityCase canon, acknowledged type1.1, current
+case and owner source. docs/security-case-execution-owner-review.md supports
+the closed adapter/receipt direction with explicit versioned schema, structural
+materialization provenance, unchanged caller/session boundaries, safe CAS
+reconciliation and exact-created-object rollback requirements. This is owner
+review, not approval. Supporting file digests are in the adjacent sources JSON.
+
+Current source exposes a circular wait: ops-mason T03 waits on mint while Warden
+and the broker refuse a non-materialized case. Structural acceptance therefore
+needs its own native pinned receipt before mint, not a successful mint before
+materialized. The platform broker additionally pins type1.0 while Forgejo is
+accepted at1.1; platform-owner alignment and tests are required, not an unchecked
+version bypass. T06 remains wait. No case/type lifecycle status, grant, authority
+or live runtime changed by this review. A proposed informed-decision would
+adopt the source contract only; native materialization and execution acceptance
+stay distinct.
+
+Final proposal re-review: staged Warden proposal SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+adds only the explicitly local reducer appendix, not an accepted wire protocol
+or executor. The exact-final review and sources JSON supersede the earlier
+1035f049... proposal review. Platform staged the exact type1.1 broker correction
+with ten fake-backend subprocess checks (script SHA256
+9576cd211cfc06526ec4cc9bd0a5b06f0f59287a68931bb2d6e3592a951ddc7d).
+The next source work is the versioned closed adapter/receipt/materialization
+contract, not another relaxation of the broker's status gate. Native work still
+requires installed broker provenance, structural reader receipts, exact new
+materialized-case bytes, caller grant/session revocation and verified execution.
+No installed/native acceptance is inferred from that staged correction.
+
+2026-10-11 — new source-only type1.2 architecture acknowledgment:
+Confirmed native founder ACCEPT of infd-20261011-forgejo-type12-source-r1@1
+at06:47:39Z, approval8e9332c8-754a-420c-b8b7-445cb4fe6765. Exact frozen packet
+0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68 and submission
+585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569; native receipt
+retained in docs/evidence/2026-10-11-forgejo-type12-source-acknowledgment/.
+The complete acknowledged1.2 source package is isolated under
+security-case-type-revisions/1.2/oidc-browser-relying-party; default loader and
+current accepted1.1 case remain untouched because load_type is single-version.
+The new proposed1.2 case is NOT accepted/materialized/live and has no acceptance
+fields. Actual reference-migration design approval is a separate Apps owner
+receipt; no1.1 approval is inherited. Source-recording review/test proof and exact
+next gates are in docs/forgejo-type12-source-acknowledgment-followthrough.md.
+T06 remains wait and T07 remains its existing dependent task; type is NOT
+implemented and no first-case/native grant or broader workplan finish is asserted.
+
+2026-10-11 — bounded explicit version selection source preparation for T06:
+The validator now offers optional exact version_roots/--version-root VERSION=PATH
+selection with duplicate/mismatch/traversal/symlink refusal and no fallback. The
+default1.1 source and historicalacceptedcase hashes/ordinaryrefusal/preparation
+render stayunchanged; actual1.1 is acknowledged, not implemented. Acknowledged1.2
+ordinaryadmission also refuses; optionalpreparation remains nonexecuting.43local
+validatorchecks pass and original1.1 CLIrenderbytes match exactly. Makerproof:
+docs/evidence/2026-10-11-explicit-type-version-selection/source-integration-validation.json.
+FormalNetownerreview/reference-source integration and all existing native adapter,
+provenance/broker/materialization/attendedproof gates remain; T06 stayswait, no
+new residual or firstcase/typeimplementation/native grant is inferred.
+
+
+2026-10-16 — isolated source preparation for T06 (canonical integration pending):
+Added `check-evidence` to the existing validator CLI. It reuses exact version
+selection and ordinary type/case/render admission, checks actual Mason structural
+request source/inventory/projection pins and reads actual Warden journal rows
+read-only. Successful rows require exact type-declared descriptors and attempt/
+revocation fingerprints. Existing acknowledged types without machine descriptors
+remain plan-only. The compatibility result never claims authenticated native
+completion: Request and journal fingerprints are not portable native evidence.
+Owner authentication/status binding and actual native gates remain unresolved;
+T06/T07 statuses and both type/case lifecycles remain unchanged. No dispatch,
+credential access or authority expansion is introduced. See tool README for the
+existing owner protocol boundaries and source integration tests.
+
+Concrete next Warden owner integration: current `Executor.admit` refuses every
+case parameter whose sensitivity is not public/operational, so browser
+`redirect_uris`, `allowed_scopes`, `client_type`, `mfa_required` (and 1.2
+`consumer_namespace`) fail after otherwise prepared admission. The sensitive
+classification is a security-change review level, not secret content. The
+Warden owner must validate through NetKingdom's existing exact-version case/type
+validator, then project only descriptor-declared safe target metadata; do not
+remove the credential/value refusal or copy complete parameters into journals.
+Actual owner descriptor acknowledgment and independent evidence admission remain
+prerequisites, with normal admission still refusing unimplemented types.
+
+
+## T10 — Source compatibility checker for Mason and Warden evidence
+
+```task
+id: NK-WP-0048-T10
+status: done
+priority: high
+state_hub_task_id: "4b06ca97-c1e4-5680-bf22-ab75ab1646a4"
+```
+
+Completed 2026-10-16 in published source `c31d21ba`. The read-only
+`check-evidence` command checks the actual Mason structural request and Warden
+journal source protocols against an exact version/render. Independent source
+review passed 103 tests at that checkpoint. It always reports native completion
+false and execution prohibited. Fixtures and local journal fingerprints do not
+provide authenticated owner/native evidence. This records completed source scope
+previously described under T06; it does not duplicate native acceptance credit.
+
+## T11 — Validate the optional machine-descriptor pin contract
+
+```task
+id: NK-WP-0048-T11
+status: done
+priority: high
+state_hub_task_id: "ef2a0119-f59e-5e45-9519-115da9df7b85"
+```
+
+Completed 2026-10-16. Reproduced the JSON schema rejecting a valid
+`execution_descriptors` map while the Python validator accepted malformed maps.
+The schema now supports the existing Warden optional exact-byte pin map; semantic
+validation binds keys to declared steps, bounds the map and checks digest shape.
+The direct evidence API refuses malformed maps before accessing them. Twenty-one
+new checks and all 127 affected source checks passed. No current type/case bytes,
+status, owner descriptors or native acceptance changed. Source evidence and
+publication receipt: Custodian
+`docs/changes/netkingdom-target-2026-10-16/browser-acceptance-next/`.
+
+## T12 — Prepare NetKingdom-owned attended step adapters
+
+```task
+id: NK-WP-0048-T12
+status: todo
+priority: high
+state_hub_task_id: "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd"
+```
+
+Owner: NetKingdom. Retained scope: prepare bounded attended Deployment env,
+config verification and restart/readiness steps around the existing helpers.
+Next action: identify exact current entry points and their revision/readback
+contracts, then implement fixed source-pinned callbacks or receipt-only attended
+steps. Completion requires positive/refusal checks, exact target/source pins and
+uncertainty behavior without acquiring user-engine runtime identity or exposing
+registry/client secrets. Existing caller/session, cluster/issuer, CAS/readback
+and status-only output boundaries remain mandatory.
+
+2026-10-16 task refinement: the original broad adapter scope is split into T13
+(completed registration source candidate), T14 (group creation provenance), T15
+(durable registration recovery) and T16 (descriptor/artifact selection and owner
+review). This preserves T12's task ID and Hub UUID while giving each remaining
+outcome an owner and completion gate. T06 now names every source dependency;
+its native/reference lifecycle acceptance scope remains unchanged. Completion
+of any source task supplies no Warden, Platform or Apps assent and no native
+execution authority.
+
+## T13 — Prepare the fixed registration adapter source candidate
+
+```task
+id: NK-WP-0048-T13
+status: done
+priority: high
+state_hub_task_id: "b264c10b-565c-5d29-b788-03cf5fbd2883"
+```
+
+Completed 2026-10-16, source implementation and synthetic fixture proof only.
+Added an injection-only adapter around actual `keycape-client.run`: fixed
+case/principal/human/lane/source/acceptance binding, existing CAS/readback,
+metadata-only owner evidence and per-attempt parent-session revocation boundary.
+The descriptor source composition pins the exact checker executable digest
+alongside adapter/helper source. Creation-only rollback authenticates its
+creation receipt and refuses changed postcreation UID/resourceVersion;
+pre-existing clients confer no rollback authority. Missing readback, evidence,
+revocation or process-local creation provenance cannot become retry-safe success.
+
+Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/`
+R3 candidate, explicit patch and postimages, retained R1 rejected custody finding
+and R2 revision, and 36 passing source checks (16 new, 20 existing). Three checks
+use actual Warden kernel admission/dispatch/rollback with published Warden
+`d97652a3bb5fa733b063d71a1b74068efcccf572` producer pins unchanged. Owner trust,
+descriptor/type/case and Kubernetes objects remain synthetic fixtures. This
+records a completed source deliverable, not independent review, publication,
+type acknowledgment, exercised procedure, identity admission or native browser
+acceptance. Independent root source review: Custodian browser-adapter-next/coordinator-review-r3.json. Source integration and normal publication/synchronization receipts: Custodian browser-adapter-next/canonical-integration.json. These receipts supply no other-owner assent or native authority.
+
+Source publication: `0775c2bfa41af236301155bb5a69bbf088bdf823`, independently
+reviewed by the Custodian coordinator before integration. The required initial
+projection and ordinary UUID writeback both completed with zero failures and
+zero automation errors. Generated-only brief commits were refused by the normal
+hook; exact pre-existing staged/working brief bytes were restored. The separate
+canonical integration receipt retains those refusals and projection evidence.
+Native admission and all other-owner acceptance remain open.
+
+## T14 — Admit governed group rollback against native owner boundaries
+
+```task
+id: NK-WP-0048-T14
+status: progress
+depends_on: [NK-WP-0048-T20, NK-WP-0048-T21]
+priority: high
+state_hub_task_id: "fce95440-a25b-5f27-8ef3-a3d182099113"
+```
+
+Owner: NetKingdom. Next action: bind the completed T21 PostgreSQL journal to
+an admitted dedicated CNPG consumer through the existing `rapp-postgres`
+database-per-consumer contract. Identify the actual deployment/package and
+custody owner, admitted placement/capacity and role/renewable lease/TLS target;
+implement the independently retained exact content checkpoint and authoritative
+tenant/case/source/principal callbacks before enabling governed group operations.
+The injection-only backend and fixture callbacks do not supply production scope
+or authorization. Existing service tokens, caller-supplied JSON and provenance
+receipts confer no new grant. The default production endpoint remains disabled
+without the trusted integration. SQLite remains local/disposable only; any
+production exception requires explicit scoped governance under ADR-0015.
+
+2026-10-17 owner-integration refinement: T23 records the completed source/package
+placement review, distinct from T21's source/disposable-SQL proof. Its dedicated
+`rapp-identity-provisioner` recommendation is draft and unbound, not an accepted
+package or existing repository. The full six-consumer rapp-postgres renderer
+accepts the inert candidate on platform-pg-2 as its third of four declared
+consumers; first-cell placement is refused as a fifth. Neither the estimated
+four-consumer ceiling nor source requests establish native headroom or backup.
+
+Next independent owner contracts: NetKingdom/package/substrate owners accept
+exact deployment/rollback fate; rapp-postgres admits the dedicated consumer,
+roles, five-connection budget and actual backup/restore; Platform admits exact
+renewable runtime/migration delivery and TLS/CA/SAN; network owners scope SQL,
+broker and checkpoint paths without assuming a narrow policy subtracts additive
+same-namespace access. Protected caller owners must provide authoritative
+GroupJournalBinding construction and current authorization; an independent
+existing holder must authenticate and atomically advance the exact content
+checkpoint, not a counter or ordinary Audit receipt. Directory/runtime owners
+must select and prove either an exclusive all-writer maintenance barrier or
+provider-supported CAS/generation, including established sessions, lifecycle
+cascades and remove/readd ABA. No source review establishes those owner facts.
+
+The default PostgreSQL activation and destructive native rollback remain refused.
+Storage/lease acceptance can be proposed separately from LDAP mutation only after
+exact owner source/target/custody/verification/recovery and cost/risk review;
+State Hub guard approval grants none of it. Source-only integration review and
+native acceptance matrix: Custodian native-storage-r1/OWNER-REVIEW.md. T14's
+existing status, UUID, dependencies and native completion gate are retained.
+
+2026-10-17 refinement: T20 retains the historical durable SQLite source and
+actual disposable LLDAP proof. T21 extracts the completed PostgreSQL source and
+bounded real disposable SQL compatibility proof. T14 remains `progress` for
+native CNPG admission/recovery, protected owner integration and exclusion of all
+external LDAP writers. Separate source publication/projection and independent
+cleanup receipts belong to coordinator follow-through; no missing native assent
+is represented as received.
+
+Completion still requires independently reviewed/admitted ADR-0015-conforming
+CNPG storage (or an explicit governed exception), backup/lost-store recovery and
+migration of legacy requests; a native
+writer-isolation/fencing or provider CAS/version contract that closes external
+writer races and remove/re-add ABA; exact case/source/principal and current
+native object bindings for protected callbacks; and actual per-attempt evidence,
+revocation and readback/refusal verification through the existing owner paths.
+Only independently retained confirmed creations may be undone. Every
+pre-existing/shared group and membership must remain preserved; unresolved
+intents never expire into retry authority. The disposable fixture supplies none
+of these native custody, authorization, owner-acceptance or production claims.
+
+## T15 — Define authenticated recovery for lost registration process state
+
+```task
+id: NK-WP-0048-T15
+status: wait
+depends_on: [NK-WP-0048-T31]
+blocking_reason: "Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source."
+priority: high
+state_hub_task_id: "1b825705-4848-5edc-832f-b1622cd9bdb7"
+```
+
+2026-10-17 source part merged (061461e via 65559ef). `build()` takes optional
+paired `holder`/`observe` capabilities and installs `reconcile_original`; the T31
+fixtures now run through the adapter's own path. Rollback after restart is still
+refused, and there is no add replay. This changes `keycape-registration-adapter.py`,
+so the revision reviewed under Custodian `browser-adapter-next/coordinator-review-r3.json`
+is superseded. The new revision has no independent review yet and must not be
+pinned on the strength of the old one.
+
+2026-10-17: T31 fixtures done (74adcd7). What remains for T15: the owner
+selects the real authenticated original-attempt holder, and the T13 adapter
+gains the holder capability, `reconcile_original` and reconcile-aware `verify`
+described in T31.
+
+Owner: NetKingdom for registration state, with Warden owning kernel evidence
+admission. T22 records the completed source review and exact existing-seam gaps;
+T15 retains implementation and authenticated restart/lost-receipt acceptance.
+Next action: identify the actual owner publisher/authenticator and bounded
+original-attempt readback contract, and obtain Warden's reviewed original-intent
+lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
+retains attempt identity in historical rows but only hashes evidence references;
+load drops that context and reconcile passes a fresh attempt to the callback.
+The adapter's original payload and creation record remain process-local. Neither
+that journal nor a current matching registry entry reconstructs creation authority.
+
+The owner contract must bind the original Invocation, case/type/descriptor/catalog/
+acceptance pins, source, principal and admitted tenant/realm provenance, separately
+from the new reconciliation attempt and its independently revoked parent session.
+Use an existing authenticated holder/readback; Audit Core's custody API is a
+candidate only until its actual registration source/class, load-bearing emission
+contract and separate scoped reader are admitted. No new broker or receipt trust
+root is proposed. A missing original record, ambiguous publication, NO_CHANGE,
+changed native revision or lost readback stays uncertain; no add replay or undo.
+
+Completion requires restart/lost-receipt fixtures against the selected actual owner
+contract: independently authenticated original created-only provenance, original
+exact client entry and unchanged current postcreation UID/resourceVersion before
+any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
+The T13 adapter deliberately refuses post-restart rollback and installs no
+reconciliation callback. Existing source review, JSON receipts and synthetic
+trust do not satisfy native holder acceptance or authorize attended recovery.
+Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
+
+2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
+is not published — ops-warden head is `d97652a`, with no WARDEN-WP-0044-T03
+commit, and the net-kingdom inbox holds no announcement. No restart/lost-receipt
+fixture or readback seam was added this session; the work is deferred behind
+T16's decomposition under the same token budget. Remains todo, gated on Warden
+publishing the reviewed lookup/context interface and on owner selection of the
+authenticated original-attempt holder.
+
+## T16 — Select and review the actual machine descriptor composition
+
+```task
+id: NK-WP-0048-T16
+status: todo
+depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29, NK-WP-0048-T30]
+priority: high
+state_hub_task_id: "200bf500-5084-5ae7-be26-3033fe1f296e"
+```
+
+2026-10-17 coordinator review r4 approved the 1.3 candidate at 1920b13 with no
+findings (the-custodian `nk48-adapters-1.2-review/coordinator-review-r4.json`). The founder chose
+option A of the T16 owner-review packet (`nk48-t16-owner-review/founder-option-decision.md`):
+1.3 with execution descriptors for all seven steps. Owner reviews for A are open
+in the-custodian `docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/` (net-kingdom,
+railiance-platform, railiance-apps, ops-warden, key-cape). The owner-review packet
+supersedes the r1 composition pointer: T16's exact composition is now
+`sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json`.
+
+2026-10-17 successor candidate prepared (source only, `proposed`):
+`security-case-type-revisions/1.3/oidc-browser-relying-party/` is the 1.2 package plus
+an `execution_descriptors` map of the seven composed descriptors, with examples
+pinned to `@1.3` and no acknowledgment. ensure-groups, hand-over,
+deliver-consumer-secret and the composer accept 1.3 (835680c, merged acda26c).
+`test_admit_1_3_type.py` runs Warden's real admission against the committed 1.3 type:
+the proposed type is refused; an acknowledged copy is refused because ops-warden
+pins parameter fingerprints only for 1.1 and 1.2; and with only a 1.3 pin (equal to
+1.2's fingerprint) all seven are admitted. This is a major change under canon
+section 6. Next: r4 source review of the changed adapters and the map, then owner
+reviews, including the ops-warden 1.3 pin, the mint-secret warden_executes/human
+question and the owner-run steps question, then the founder's Decision Memo.
+
+Owner: NetKingdom for descriptor/type source and exact checker artifact; Warden
+independently owns global provenance/admission. T22 records the completed seven-step
+source1.2 inventory and regenerated register-client descriptor using the delivered
+checker and current sealed-snapshot source; T16 retains exact owner review,
+complete descriptor composition and admission. Next action: bind actual native
+publisher/authenticator, original/current session verification and revocation,
+executable storage/custody and config pins, then obtain the six missing fixed
+owner descriptors/adapters for ensure-groups, mint-secret, deliver-secret,
+bind-env, deliver-consumer-secret and hand-over. The inventory identifies each
+existing owner seam, exact missing contract and created-only rollback requirement;
+it is not an executable bundle. T14 and T15 remain independent prerequisites.
+
+Review the dedicated consumer source1.2 composition only through the existing
+explicit version-root selection. Keep canonical1.1/default and its accepted case
+unchanged, and the source-only acknowledged1.2 reference case proposed without
+acceptance fields. New descriptor bytes require a reviewed exact successor
+revision/version under canon section6; they do not inherit historical source
+acknowledgment. Changed authentication/materialization/trust needs the prescribed
+informed-decision acknowledgment. Do not insert a partial descriptor map or use
+--allow-unimplemented preparation as ordinary case/native admission. The registry
+helper reports restart_required; separately review quiet-window restart/readiness
+and actual consumer verification rather than infer activation from registry CAS.
+Exact composition: Custodian native-registration-r1/descriptor-composition.json.
+Completion requires separate owner source review of exact machine descriptors,
+artifact/source/config pins, normal type/version admission and independent
+evidence-verification boundaries. Warden d97652a refreshes producer validator
+pins for NetKingdom 015694ee; it does not attest T13's new adapter. Pinning any
+machine descriptor into an acknowledged type is a separately reviewed source
+change. Platform owns structural/mint/broker/delivery evidence; Apps owns actual
+consumer login/group enforcement. Neither their assent nor native acceptance is
+supplied by this task.
+
+2026-10-16 source checkpoint: T19 below extracts the completed per-attempt
+executable snapshot implementation and reviewed fixture proof. T16 retains
+native executable storage/custody, exact owner evidence/session callbacks,
+complete descriptor composition and ordinary type/version admission. The
+successor descriptor/source pins are proposed only; the earlier descriptor
+history is preserved. T14 group provenance and T15 durable restart/recovery
+remain independent open requirements. No native acceptance is counted here.
+
+2026-10-17 budget checkpoint (net-kingdom-worker): no source change made. The
+T13 registration adapter alone is 217 source and 317 test lines plus an
+independent review; six further owner descriptors/adapters cannot be completed
+within one per-task token budget (soft 8000 / hard 10000), so the task was
+stopped below 50% and is decomposed rather than pushed through. Proposed split,
+one source-candidate task each with positive/refusal fixtures, canonical1.1
+default unchanged and no --allow-unimplemented admission: (a) ensure-groups,
+bound to T14's journal/provenance seam; (b) mint-secret and (c) deliver-secret,
+Platform-owned evidence seams; (d) bind-env and (e) deliver-consumer-secret;
+(f) hand-over, Apps-owned consumer verification; then (g) descriptor composition
+over the reviewed set. Each candidate needs its owner's source review before
+pinning; none is authored here as owner-accepted. Status stays todo.
+
+## T17 — Build and exercise the exact offline config-checker artifact
+
+```task
+id: NK-WP-0048-T17
+status: done
+priority: high
+state_hub_task_id: "8c3e4baa-a218-5996-af9e-fe1153a46dac"
+```
+
+Completed 2026-10-16, isolated artifact/source fixture proof only. Built the
+existing `key-cape/src/cmd/keycape` command from published clean source revision
+`3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, source tree
+`f0010b9cab17dbc3a787628a29657d98b900320f`, with cached Go 1.23.0,
+CGO disabled, Linux/amd64 v1, trimmed paths, disabled VCS stamping and offline
+read-only module selection. The full retained closure pins 108 source files,
+9876 toolchain files and ten used module source directories. Three isolated
+build locations produced identical 13633409-byte artifacts:
+`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
+
+Eight disposable checks use the actual executable and maintained helper/kernel,
+with complete synthetic configs and a minimal environment: add/created-only
+removal, normal pinned producer admission, rollback, lost-readback uncertainty,
+stale revisions, substituted checker refusal, invalid startup config and missing
+secret-env refusal. No checker stub or producer-pin override remains. The
+artifact-bound descriptor proposal is
+`sha256:76b1153d188062ece53fcd5e8d35290fdbfd02a69dd79d4b001fc42781afcdc3`.
+Evidence: Custodian
+`docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/`.
+The first two build attempts succeeded but their closure collection failed;
+both failures are retained, as is refusal of the older incomplete synthetic
+fixture. No production config, credentials or cluster mutation was used.
+
+This extracts completed build/fixture scope from T16 without claiming KeyCape
+owner endorsement, native checker selection/storage custody, acknowledged type
+integration, native evidence/session callbacks or attended browser acceptance.
+T16 retains exact owner review and composition/admission scope. The attended
+registration procedure remains unexercised.
+
+## T18 — Make checker input and executable selection deterministic
+
+```task
+id: NK-WP-0048-T18
+status: done
+priority: high
+state_hub_task_id: "9c45da71-fb4c-5f20-9065-90f448f37c64"
+```
+
+Completed 2026-10-16, isolated source correction and real-artifact fixture proof
+only; independent integration/publication remain separately recorded. KeyCape
+source review identified non-secret `KEYCAPE_ACCOUNT_PORTAL_URL` and
+`KEYCAPE_BROWSER_LOGOUT_URL` overrides in config.Load. The original helper
+inherited ambient environment, allowing valid supplied configuration to be
+rejected or invalid supplied URL configuration to be admitted. A bare relative
+checker filename could also be replaced by PATH lookup after the adapter had
+hashed the selected local file. All three counterexamples are retained against
+the unchanged predecessor.
+
+The existing helper now resolves the selected checker file to an absolute path
+and passes an explicit empty subprocess environment. Three opt-in real-checker
+regressions verify both URL-verdict directions and relative-file selection under
+a non-checker PATH decoy. All 39 affected checks pass with the exact supplied
+artifact, as do 11 real-artifact helper/kernel scenarios. Source evidence:
+Custodian `docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/`.
+Historical descriptors remain retained; the helper correction changes successor
+source-composition pins and requires their separate review/admission. An absolute
+path is not immutable custody and does not eliminate file replacement races;
+T16 retains native executable storage/custody and callback/type admission.
+No production configuration, credentials or cluster mutation was used.
+
+Source integration and publication: `916ba4b33e03179274d03b78bd898a4843e8653f`, following independent
+Custodian source review in browser-checker-environment-r2/coordinator-review.json.
+The ordinary protected projection pass assigned T17/T18 UUIDs with zero failures
+and zero automation errors; generated-only brief commit refusal is retained.
+The exact prior staged/working brief bytes were restored. Final source/publication/
+projection evidence is retained in Custodian browser-checker-environment-r2/
+canonical-integration.json. These source receipts do not admit native executable
+custody, owner callbacks, acknowledged type changes or browser identities.
+
+## T19 — Bind checker execution to verified immutable attempt bytes
+
+```task
+id: NK-WP-0048-T19
+status: done
+priority: high
+state_hub_task_id: "f50fdcd1-00be-5c3c-be0c-345aa2126032"
+```
+
+Completed 2026-10-16, independently reviewed source implementation and synthetic
+fixture proof only. The registration adapter now opens a bounded regular checker
+artifact without following its terminal symlink, verifies the reviewed digest,
+and snapshots the exact bytes into a write/grow/shrink/seal-removal-sealed Linux
+memfd before helper access. Live and proposed config checks execute that same fd
+through procfs with the existing empty environment; the fd closes on completion
+or failure. Unsupported snapshot/seal/exec policy refuses through the existing
+parent-session revocation and uncertainty boundaries. The earlier unbounded
+pre-snapshot path read was removed during independent review; actual adapter
+symlink/FIFO/oversize refusal tests verify helper access never starts.
+
+Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/`,
+including exact base/preimages/postimages/patch, proposed descriptor, coordinator
+source review and canonical integration receipt. Independent Custodian checks
+passed 49 affected source tests and 12 actual Go checker/helper/kernel scenarios;
+the sets overlap and are not separate acceptance counts. Existing published
+Warden d97652a producer pins remain unchanged. The exact KeyCape artifact remains
+`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
+The predecessor path-replacement refusal and the first expanded reopened-fd test
+failure are retained; the latter fixture was corrected to restore write mode
+before independently proving seals block reopened-fd writes and shared mmap.
+
+This source task adds no native owner custody, callback, evidence trust, type
+acknowledgment, credential access, consumer sign-in or rollback acceptance.
+Executable memfds, Linux seals and usable procfs are explicit runtime dependencies
+and still require native admission. This is an extracted source outcome from
+T16, not completion of T16; T12/T14/T15 and all external-owner gates remain open.
+
+
+Publication verified by the coordinator after the source worker usage limit:
+`8790dd18ae83c4651ef3d1d923312a118a5b436b` is the actual remote main revision.
+All five canonical source hashes match the reviewed packet. Normal synchronization
+completed with zero failures/automation errors; all 19 task statuses match the
+projection. T19's assigned UUID is retained. The original staged and working brief
+bytes were restored and independently compared. The exact source, projection and
+publication checks are in Custodian browser-resume-r1/canonical-integration.json.
+Native acceptance remains open under T16 and the other named owner tasks.
+
+
+## T20 — Prepare durable group provenance and prove disposable LLDAP compatibility
+
+```task
+id: NK-WP-0048-T20
+status: done
+priority: high
+state_hub_task_id: "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
+```
+
+Completed 2026-10-17, source candidate preparation and bounded synthetic
+compatibility proof only. This extracts evidenced implementation/fixture scope
+from T14; T14 retains native storage, writer isolation, protected callback and
+owner-acceptance gates. Source integration/publication and State Hub projection
+are pending the coordinator's separate receipts; no revision or task UUID is
+invented here.
+
+The existing identity-provisioner group ensure/revoke interface now has a
+reviewed candidate for a bounded owner-private SQLite journal, proven only in
+local/disposable use. The initial storage instructions wrongly suggested a native
+persistent-volume path; source review against accepted ADR-0015 corrected them
+before publication. Production SQLite-on-a-PVC is not admitted: T14 retains
+CNPG/rapp-postgres storage admission or a separately governed exception.
+The local journal saves
+complete prestate and intent before each attempted directory mutation, inventories
+only confirmed new groups/memberships, binds original ensure idempotency and
+correlation to the exact request digest, and refuses unsigned caller inventories
+or legacy broad revoke requests. Replays never recreate removed state. Missing,
+replaced or untrusted storage and missing intent rows stop execution; definite
+before-mutation refusals retain evidence without stranding unrelated valid work.
+Interrupted writes/readback remain unresolved across reopening. Revoke validates
+all targeted native ids and complete member postimages before destructive work,
+removes only confirmed creations and never deletes a preexisting empty group.
+Server/configuration wiring, image-copy closure and owner storage/request
+migration instructions are included. The existing endpoint's caller
+authentication remains the existing boundary, not a new grant.
+
+The candidate was prepared against NetKingdom
+`878abc93588e12b6da1bac055cfbb3abb8d7adf1`; exact source patch digest
+`sha256:1f3f3ca94c46dadac8f24896053d4d23179de795e50a24298a0cfbcc46cca30e`.
+The independent Custodian review passed all 65 provisioner checks. The earlier
+62-check candidate, two independent-review findings and subsequent fixes remain
+retained rather than overwritten. Seven additional fixture-plan checks exercise
+the preparation boundary; these counts overlap the same candidate and do not
+measure task-completion percentage or independent acceptance.
+
+A separately reviewed bounded fixture then exercised the exact candidate against
+cached pinned disposable LLDAP and Python images, through actual GraphQL. All 14
+closed compatibility/containment oracles passed: exact creation inventory,
+separate-process SQLite reopening/replay/revoke, complete preexisting directory
+preservation including empty/shared groups and memberships, refusal of shared
+membership drift, retained uncertainty after a lost response following a real
+addition, and refusal of unknown/cross-case receipt bindings. The fixture used
+only newly generated synthetic users/passwords/key material in private tmpfs,
+with a network-none anchor and shared loopback helper, no host ports/mounts,
+no image pulls and no production or actual credential contact. The coordinator's
+safe receipt reports both exact owned containers absent after cleanup; final
+independent cleanup verification remains the coordinator's integration duty.
+
+Evidence: Custodian
+`docs/changes/netkingdom-target-2026-10-16/group-provenance-r1/`, including exact
+source base/pre/postimages, patch/manifest, independent review and retained
+refinements. Native fixture manifest
+`sha256:8a0514f5f14137355972400cd4852f48c892316d28e3abd3c86635d7cb81eef2`;
+retained safe result `native-fixture/execution-result.json` (original
+`/tmp/nk48-groups-native-review-5pywb19z/result.json`). The source task supplies
+no native owner assent, production rollout, protected session/evidence callbacks,
+ordinary type admission or consumer login proof. LLDAP has no conditional
+membership mutation or generation token here: exact readback cannot exclude
+ABA or a concurrent external writer, so T14 remains open.
+
+2026-10-17 verified source follow-through: source commit `4f65e41` passed normal
+local scanning and all 65 canonical provisioner tests. The actual disposable
+LLDAP receipt passed all 14 oracles; independent verification on the pinned
+daemon found both exact names and the run label absent. Source integration
+includes the ADR-0015 documentation correction; the journal remains local-only.
+
+T14 source preparation is underway. Twenty-three pinned public sources identify
+NetKingdom implementation/reconciliation, Platform custody/database governance
+and rapp-postgres consumer provisioning; the inspected runtime binding does not
+assign identity-provisioner a package. The existing User Engine runtime token
+and pod route are not a protected-case caller lane. The native proposal preserves
+the same journal seam on a dedicated CNPG consumer and requires authoritative
+scope binding, admitted role/lease/placement/recovery and all LDAP writers fenced.
+The declared exclusive maintenance window is not mechanical exclusion of WebUI,
+helper or lifecycle writers. Capacity placement and EUR cost/risk remain owner
+decisions. No package, database, credential, rollout or owner assent was created.
+Custodian evidence: group-provenance-r1/native-storage-proposal-r1; final source,
+projection and cleanup review: resume-integration-r1/publication-verification.json.
+
+
+## T21 — Implement the PostgreSQL journal and prove disposable SQL compatibility
+
+```task
+id: NK-WP-0048-T21
+status: done
+depends_on: [NK-WP-0048-T20]
+priority: high
+state_hub_task_id: "afe78e4d-408a-516a-ab92-e212e8a2d11d"
+```
+
+Completed 2026-10-17: bounded source preparation and actual disposable PostgreSQL
+compatibility only. T14 retains native storage, custody, callbacks, authorization,
+all-writer isolation and production admission. Coordinator source publication and
+projection remain separate follow-through; no source revision or task UUID is
+invented here. T20 remains the historical local SQLite/actual LLDAP proof.
+
+The eight-path source candidate adds an injection-only PostgreSQL implementation
+behind the existing owner journal seam, with explicit trusted tenant/directory/
+case/source/principal/epoch binding and independent continuity callbacks. It
+persists bounded intent/created-only receipts, exact-one version updates, durable
+active fences, and a content-bound journal chain. SQL commits precede independent
+exact-marker acknowledgment; lost replies/checkpoints poison continuation and
+retain uncertainty. A counter-only checkpoint is explicitly insufficient for
+divergent clones. Migration does not create database/schema/credential, admit an
+epoch or clear quarantine; production HTTP activation is absent pending trusted
+callbacks. Pinned psycopg package/image-copy closure is included, without claiming
+an image build or native dependency admission.
+
+Candidate base `6cb43c0cc55212363a5406b02db046e2384a7c40`; final eight-path patch
+`sha256:5549d2982b61ff70aba4b3928fecd5639db0f1a732ab2f8630f678e7acf4d34d`.
+All 82 source tests pass, alongside 13 fixture plan/diagnostic checks and two
+source-backed snapshot regressions. Counts overlap the same source and fixture;
+they are not additive native acceptance or completion percentages.
+
+The independently reviewed R5 fixture ran the actual SQL migration/backend and
+existing provisioner path against cached pinned disposable PostgreSQL. Directory
+operations deliberately used the existing synthetic LLDAP test double. All
+manifest-declared phase oracles passed: creation-only inventory and DDL refusal;
+separate-process replay/revoke with complete preexisting/shared visible-state
+preservation; foreign-context refusal; concurrent exactly-once reservation and
+stale version refusal; actual database fork with divergent bodies at the same
+counter and fresh-object rejection of the losing exact checkpoint; retained
+uncertainty after checkpoint/directory/SQL response loss; and actual pg_dump/
+pg_restore rollback refusal against the independently retained fixture checkpoint.
+The checkpoint is fixture-only, not an admitted native owner evidence holder.
+
+Only generated credentials/state were used, with two nonroot/read-only containers
+on private loopback, bounded tmpfs/CPU/memory/PIDs/lifetimes, no host ports/mounts,
+no pulls and no production contact. The safe receipt reports both exact owned
+containers absent, with no daemon uncertainty. Independent final pinned-daemon
+cleanup verification remains coordinator follow-through.
+
+Failed R2/R3/R4 receipts and source revisions remain retained. R2's helper failure
+subphase is unknown; R3 exposed a real backend bug where replacing nested receipt
+objects lost the created ID held by ensure, fixed by acknowledging only the backend
+version after commit/checkpoint. R4 verified that fix through actual SQL bootstrap,
+then exposed fixture snapshot aliasing and empty deleted-group backing entries;
+source-backed regressions corrected the snapshot without weakening complete
+visible-prestate equality, and reject nonempty orphan membership. These refinements
+belong to one trial, not extra native acceptance successes.
+
+Custodian evidence: `docs/changes/netkingdom-target-2026-10-16/group-postgres-r1/`;
+exact source/pre/postimages and retained predecessors; native R5 manifest
+`sha256:d51f90816616848b93bcdc482e10a98d07061deb01eeed9e50700fc6e68b6051`;
+`final-integration-r1/typed-execution-evidence.json` and byte-exact safe receipt
+(original `/tmp/nk48-postgres-native-review-sguj7t8p/result.json`). No CNPG native
+storage/HA/backup/lease/TLS/capacity/restore admission, authoritative protected
+callbacks, real LDAP writer fencing/CAS/ABA exclusion, owner assent or production
+endpoint activation is claimed. Those remain live T14 work.
+
+
+## T22 — Establish registration recovery source gaps and complete descriptor review inventory
+
+```task
+id: NK-WP-0048-T22
+status: done
+priority: high
+state_hub_task_id: "ea50d93b-0d04-55d2-98c4-9b6c3fe925b1"
+```
+
+Completed 2026-10-17: source-only owner-contract review and complete review
+inventory. Inspected the actual registration adapter, Warden Journal/Executor,
+NetKingdom evidence compatibility checker and Audit Core custody/read surfaces.
+No existing admitted holder/readback supplies authenticated original-attempt
+recovery: payload/creation are process-local, persisted evidence references are
+hashed, and reconcile receives a new attempt without original context. The exact
+four-owner contract requirements and non-replayable missing/ambiguous cases are
+recorded; no recovery callback, publisher, credential grant or native trust root
+was installed. T15 retains implementation and actual acceptance.
+
+The complete source1.2 inventory maps all seven follow-through steps to their
+existing owners, missing exact contracts and created-only rollback requirements.
+The actual maintained adapter regenerated the sole existing register-client
+machine descriptor against the delivered 13,633,409-byte checker and current
+sealed-memfd snapshot source. The checker rehash and Warden Descriptor.decode
+round-trip passed; six owner descriptors remain absent. Actual source commands
+render canonical1.1 and explicitly selected1.2 with execution.permitted false;
+ordinary1.2 case admission still refuses its acknowledged/unimplemented type.
+Canonical type/case/acknowledgment bytes were hash-checked unchanged. No tests were
+added or rerun, no native configuration or effect occurred, and no owner assent
+or complete machine bundle is claimed. T16 retains native executable custody,
+complete exact descriptors, independent source review and normal version/type
+admission. This extracted outcome supplies no native gate completion credit.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-registration-r1/`, especially
+original-attempt-review.json, descriptor-composition.json, source-verification.json,
+source-manifest.json and manifest.json. The prior sixteen-gate audit remains
+immutable. Publication, normal task UUID allocation and projection are separate
+coordinator follow-through; no Hub UUID is assigned by this source record.
+
+
+## T23 — Review native journal package assignment and storage integration boundaries
+
+```task
+id: NK-WP-0048-T23
+status: done
+priority: high
+state_hub_task_id: "6e7cd483-c7af-53a2-9d0a-3d76b6fb49ee"
+```
+
+Completed 2026-10-17: source/package placement and protected integration review
+only, separate from T21's completed PostgreSQL source and disposable-SQL proof.
+The owner review recommends a dedicated independently rolled-back
+`rapp-identity-provisioner`, owned by NetKingdom on rail-kubernetes, with a
+schema-valid draft declaration and no reef binding. No repository, registry
+entry, native package assignment or owner assent was created. Existing
+rapp-user-engine ownership/token delivery does not assign it the provisioner.
+
+The complete current rapp-postgres catalog has six declared consumers: four on
+platform-pg and two on platform-pg-2. The inert renderer-valid provisioner
+candidate fits platform-pg-2 at three of four, requesting one migration plus
+four runtime connections; placing it on the first cell is refused as a fifth.
+Normative package schema and full-catalog capacity/render checks passed. The
+four-consumer ceiling is estimated, not measured native headroom, and no current
+SQL session, backup or restore acceptance is claimed.
+
+The exact review identifies remaining package/substrate, SQL role/lease/TLS,
+network and backup/recovery contracts; independently authenticated protected
+scope callbacks; an external content-bound checkpoint holder with atomic
+advance/loss handling; and all-LDAP-writer exclusion or provider CAS/generation,
+including lifecycle cascades and remove/readd ABA. Generic Audit custody is not
+that checkpoint service. A database-only fence, final reread or one replica
+cannot exclude foreign directory writers. The native acceptance/recovery matrix
+keeps storage/lease admission separate from separately approved directory
+mutation; the production activation remains disabled pending trusted integration.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md`,
+source-validation.json and hash-bound source-references.json, plus the inert
+proposed declaration/consumer and renderer outputs. No native resource, lease,
+credential, deployment, destructive effect, independent holder or native owner
+acceptance was delivered. T14 retains these live gates with its original UUID
+and progress status. This completed review adds no duplicate T21 acceptance
+credit; publication, task UUID allocation and projection remain coordinator
+follow-through and no UUID is hand-assigned here.
+
+## T24 — Ensure-groups adapter source candidate
+
+```task
+id: NK-WP-0048-T24
+status: done
+priority: high
+state_hub_task_id: "1a3931ee-3b5f-52fc-9295-4073804f4bd2"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): ensure-groups-adapter.py, 8 tests (commit 5a2e7d6). Binds to the T14 PostgreSQL journal and refuses SQLite or a foreign binding. It accepts only canonical 1.1 cases, so T30 must add an explicit 1.2 path. It calls the provisioner's private `_group_binding`; a public helper is the cleaner shared edit.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind group creation to T14's journal/provenance seam; refuse without trusted journal callbacks.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. NetKingdom (directory) owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T25 — Mint-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T25
+status: done
+priority: high
+state_hub_task_id: "0de2a7d9-874d-578b-a076-f653fe42e30b"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): mint-secret-adapter.py, 9 tests (commit 558c5bc). Value-free receipts only. The receipt schema `railiance-platform.custody-mint.v1` and the mint/destroy capability interface are proposals that Platform must confirm.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned custody evidence seam: the adapter records value-free mint evidence only and never handles secret values.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T26 — Deliver-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T26
+status: done
+priority: high
+state_hub_task_id: "94b3cbf0-c908-5ac6-b0db-67385c3e021c"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): deliver-secret-adapter.py, 8 tests (commit 1b60f6e). The lane `platform-secret-delivery` and the schema `netkingdom.deliver-secret.v1` are proposals that Platform must confirm.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned delivery evidence seam (ESO/custody), value-free.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T27 — Bind-env adapter source candidate
+
+```task
+id: NK-WP-0048-T27
+status: done
+priority: high
+state_hub_task_id: "e56365f8-29b5-5c89-a329-8115f9f3b2a7"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): bind-env-adapter.py, 5 tests (commit 6fbce73). Binds references only. To fit the budget it does not yet wrap a full Warden `Adapter` like T13 (source-digest pin, authenticated evidence, parent-session revocation); it returns `(reference, run, rollback)`. That wrapping is a prerequisite for T30.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind the issuer Deployment env reference to the delivered secret reference, without values.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. NetKingdom runtime owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T28 — Deliver-consumer-secret adapter source candidate
+
+```task
+id: NK-WP-0048-T28
+status: done
+priority: high
+state_hub_task_id: "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): deliver-consumer-secret-adapter.py, 5 tests (commit 650c1ac). Type 1.2 only. It assumes the owner has validated ESO TokenRequest and the controller-RBAC admission; that stays an owner gate.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Consumer-side delivery evidence seam, value-free.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Platform and Apps owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T29 — Hand-over adapter source candidate
+
+```task
+id: NK-WP-0048-T29
+status: done
+priority: high
+state_hub_task_id: "129db41d-4560-5e20-9f3b-c3c91e0a5601"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): handover-adapter.py, 8 tests (commit ec63539). The owner `apps` and lane `apps-consumer-handover` are proposals that the Apps owner must confirm. It has no reconcile path; restart handling follows T15.
+
+Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Apps-owned consumer verification and hand-over receipt seam.
+Source candidate only, modelled on the T13 registration adapter
+(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
+`registration-adapter.md`). Requires positive and refusal fixtures and
+created-only rollback. Keeps canonical 1.1 as the default and uses no
+`--allow-unimplemented` admission. Done means the candidate and its tests are
+committed. Apps owner source review before pinning, and any native action,
+stay separate gates and are not supplied by this task.
+
+## T30 — Compose the descriptor set over the reviewed candidates
+
+```task
+id: NK-WP-0048-T30
+status: done
+depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29]
+priority: high
+state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
+```
+
+2026-10-17 done: coordinator review r3 (the-custodian `nk48-adapters-1.2-review/coordinator-review-r3.json`,
+fd07eaa) approved all nine files at ff8f597, with R2-F1..F3 resolved, an independent
+reconstruction of 117 passing and no open findings. This is a source review only:
+it grants no owner admission, pin or native authority. Owner review and admission
+continue under T16, which also takes the r2 observations, including the
+`warden_executes: false` steps that carry execution descriptors.
+
+2026-10-17 coordinator review r2 (the-custodian `nk48-adapters-1.2-review/coordinator-review-r2.json`)
+approved five files and rejected three, plus the artifact. The fixes are merged in
+2ee4ed0: R2-F1, mint-secret revokes the session and the broker grant
+independently (eeed8e1); R2-F2, deliver-secret binds to the admitted case and
+derives its Secret and custody path, with no caller reference (640292c); R2-F3,
+bind-env pins its five-file closure, and a new closure-completeness test checks
+every adapter (d16db30). Each regression test failed on 68f4bbb. The artifact is
+regenerated, and the full suite including kernel admission passed 117. Next is
+the r3 review. Open for owner review under T16: the type marks four steps
+`warden_executes: false`, yet each has an execution descriptor.
+
+2026-10-17 founder confirmed every proposed lane and schema name for T25-T29
+as-is. The artifact records them as `names_confirmed` (by founder, 2026-10-17),
+and no step is still `owner_confirmation_required`. Next: independent source
+review of the seven adapters.
+
+2026-10-17 founder decision (supersedes the `agent` decision below): the
+mint-secret actor is `human`. Coordinator review r1 (the-custodian
+`docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r1.json`,
+finding NK48-R1-F1) showed that unchanged kernel a45cf47 refuses every
+`effect: mint` admission whose actor is not `human` ("agent mint is
+forbidden"), so the `agent` descriptor could never be admitted. Adapter, tests
+and composer comment updated and the artifact regenerated (mint-secret
+descriptor digest now `sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9`);
+98 tests pass against a45cf47. The set needs an independent r2 review.
+
+2026-10-17 `test_admit_1_2_adapter_descriptors.py` runs Warden's own
+`Executor.admit` on all seven composed 1.2 descriptors, with the real 1.2
+type, the 1.2 forgejo example case, the reviewed `BrowserInputs` validator and
+fixture-only trust (stand-in adapters, nothing dispatched). It also pins that
+an agent mint descriptor is refused ("agent mint is forbidden") and that a
+wrong lane is refused for every step. Against the old `agent` revision
+(582ab9f) it fails as expected. Combined suite: 102 passed on ops-warden a45cf47
+and on current ops-warden. Fixture admission is not owner admission or a pin.
+
+2026-10-17 founder decision: the mint-secret actor is `agent`, not `warden`.
+The kernel is unchanged. The adapter, its test and the composer were updated and
+the artifact regenerated; all seven steps pass `Descriptor.decode` and
+`complete_executable_descriptor_set` is true (98 tests passed). The artifact
+stays `not_an_admission`, with no owner review, admission or dispatch permission.
+
+2026-10-17 composer merged (60b41a1 via 3c62bec) with follow-up 376b44b (merged;
+combined suite 98 passed). `compose-1.2-descriptors.py` loads 1.2 only through an
+explicit version root and refuses partial, duplicate, unknown or mismatched maps.
+`descriptor-composition-1.2.candidate.json` is a reviewable candidate, marked
+`not_an_admission`, with canonical 1.1 unchanged. ensure-groups and hand-over now
+carry and honour `parent-session` revocation, and the hand-over owner is
+parameterised (`railiance-apps` for Forgejo). Six of the seven steps pass
+`Descriptor.decode`. mint-secret is still refused: its actor `warden` is outside
+the kernel's human/agent set, and Platform (with ops-warden, if the kernel should
+change) must decide. Five steps carry `owner_confirmation_required` names. The
+set is complete only after both. Owner review, the canon section 6 successor
+revision and admission remain T16's.
+
+2026-10-17 prerequisites merged (65559ef; combined suite 78 passed):
+ensure-groups accepts 1.2 via an explicit `version_root='1.2'` (531151b), with
+1.1 still the default. bind-env is now a full Warden v1 `Adapter` (7442d21); its
+kernel-level fixture tests like T13's are still missing, and its `build()`
+signature changed. Composition is unblocked in source. Owner confirmation of
+the proposed step, lane and schema names remains before pinning.
+
+2026-10-17 inputs from T24–T29 that composition must resolve: T24 accepts
+only 1.1 while T28 accepts only 1.2, so add an explicit 1.2 ensure-groups path;
+T27 still needs full Warden `Adapter` wrapping; the lane, schema and owner names
+proposed in T25, T26 and T29 need owner confirmation before pinning.
+
+Split from T16 on 2026-10-17. Compose the seven-step source 1.2 descriptor set
+through the existing explicit version-root selection over T13 and T24–T29. No
+partial descriptor map, canonical 1.1 stays the default, and new descriptor bytes
+need a reviewed successor revision under canon section 6. Owner review and
+admission remain T16's.
+
+## T31 — Restart and lost-receipt fixtures against Warden's original-intent interface
+
+```task
+id: NK-WP-0048-T31
+status: done
+priority: high
+state_hub_task_id: "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a"
+```
+
+2026-10-17 done (source candidate only; merged in 7dbe75f; combined suite 69 passed): test_registration_original_intent_reconcile.py, 8 tests (commit 74adcd7), runs against the unmodified ops-warden a45cf47. The holder is a test-only in-memory store. For real T15 support the T13 adapter's `build()` needs an injected holder/readback capability, a `reconcile_original` callback, and a `verify` that accepts reconcile results. Rollback after restart stays refused until there is an owner contract.
+
+Split from T15 on 2026-10-17. ops-warden published the original-intent
+lookup/context interface in `src/warden/case_run.py` (`OriginalIntent`,
+`Journal.original_intent`, `Adapter.reconcile_original`; commit `a45cf47`).
+Build T15's restart/lost-receipt fixtures for the registration adapter against
+it: the original intent is kept separate from the reconcile attempt; wrong
+attempt/case/source/principal and unavailable-holder cases refuse; and a missing
+or ambiguous record stays uncertain, with no add replay or undo. The interface
+is Warden's own dispatch record, not owner-authenticated created-only provenance.
+Selecting the actual authenticated holder stays a T15 owner gate.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/apply_commit.py b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/apply_commit.py
new file mode 100644
index 00000000..1b1b5ac9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/apply_commit.py
@@ -0,0 +1,27 @@
+from pathlib import Path
+import subprocess,json,hashlib,re
+p=Path(__file__).resolve().parent
+r=Path('/home/worsch/net-kingdom')
+pre=json.loads((p/'preimage.json').read_text())
+name='workplans/NK-WP-0048-security-case-types.md'
+def git(*a):return subprocess.check_output(['git','-C',str(r),*a],stderr=subprocess.PIPE).decode().strip()
+assert git('rev-parse','HEAD')==pre['head']
+assert git('ls-remote','origin','refs/heads/main').split()[0]==pre['head']
+original=(p/'backup'/name).read_bytes();candidate=(p/'candidate.md').read_bytes()
+assert (r/name).read_bytes()==original
+assert hashlib.sha256(candidate).hexdigest()=='1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b'
+assert re.findall(rb'```task\n.*?```',original,re.S)==re.findall(rb'```task\n.*?```',candidate,re.S)
+(r/name).write_bytes(candidate)
+result=subprocess.run(['git','-C',str(r),'commit','--only','-m','docs: update published Warden original-context checkpoint','--',name],capture_output=True,text=True,timeout=240)
+head=git('rev-parse','HEAD')
+(p/'commit-receipt.json').write_text(json.dumps({'exit_code':result.returncode,'commit':head,'base':pre['head'],'stdout':result.stdout,'stderr':result.stderr},indent=2)+'\n')
+assert result.returncode==0,'normal commit refused; receipt retained'
+assert git('diff-tree','--no-commit-id','--name-only','-r',head)==name
+assert (r/name).read_bytes()==candidate
+for row in pre['files']:
+ if row['path'] in ('.custodian-brief.md','WORK-RECORDS.md'):
+  (r/row['path']).write_bytes((p/'backup'/row['path']).read_bytes())
+  if git('ls-files','--stage','--',row['path'])!=row['index']:
+   mode,oid,stage,path=row['index'].split();assert stage=='0'
+   git('update-index','--cacheinfo',mode,oid,path)
+print(json.dumps({'status':'committed','commit':head,'path':name}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/approved.patch b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/approved.patch
new file mode 100644
index 00000000..4b5b3752
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/approved.patch
@@ -0,0 +1,56 @@
+--- a/workplans/NK-WP-0048-security-case-types.md
++++ b/workplans/NK-WP-0048-security-case-types.md
+@@ -783,13 +783,15 @@
+ Owner: NetKingdom for registration state, with Warden owning kernel evidence
+ admission. T22 records the completed source review and exact existing-seam gaps;
+ T15 retains implementation and authenticated restart/lost-receipt acceptance.
+-Next action: identify the actual owner publisher/authenticator and bounded
+-original-attempt readback contract, and obtain Warden's reviewed original-intent
+-lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
+-retains attempt identity in historical rows but only hashes evidence references;
+-load drops that context and reconcile passes a fresh attempt to the callback.
+-The adapter's original payload and creation record remain process-local. Neither
+-that journal nor a current matching registry entry reconstructs creation authority.
++Next action: select and admit the actual owner publisher/authenticator and bounded
++original-attempt readback contract for the merged holder/observe adapter seam.
++Warden's original-intent persistence/interface (`a45cf475`) and additive validation
++(`117fec9241e7b985dfb187b992e173d0a5dc3700`) are now published and projected.
++The local Journal retains admitted nonsecret original context, validates original
++actor/attempt and metadata linkage to the original running receipt, and supplies
++it separately from the new reconciliation attempt. This local consistency is not
++independent original-holder authorization or creation provenance; neither the
++journal nor a current matching registry entry reconstructs creation authority.
+ 
+ The owner contract must bind the original Invocation, case/type/descriptor/catalog/
+ acceptance pins, source, principal and admitted tenant/realm provenance, separately
+@@ -804,9 +806,10 @@
+ contract: independently authenticated original created-only provenance, original
+ exact client entry and unchanged current postcreation UID/resourceVersion before
+ any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
+-The T13 adapter deliberately refuses post-restart rollback and installs no
+-reconciliation callback. Existing source review, JSON receipts and synthetic
+-trust do not satisfy native holder acceptance or authorize attended recovery.
++The merged T13 adapter exposes reconciliation only through paired injected
++holder/observe capabilities and still refuses post-restart rollback. Existing
++source review, JSON receipts and synthetic trust do not satisfy independent
++holder authorization/provenance or native admission, or authorize attended recovery.
+ Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
+ 
+ 2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
+@@ -816,6 +819,16 @@
+ T16's decomposition under the same token budget. Remains todo, gated on Warden
+ publishing the reviewed lookup/context interface and on owner selection of the
+ authenticated original-attempt holder.
++
++2026-10-17 current-source correction: the earlier same-day `d97652a` lookup
++checkpoint and T31 adapter-next-action note above are historical and superseded
++by the published Warden interface/validation and merged `061461e` adapter seam.
++The 54 focused Warden checks establish source behavior only. Current admission
++leaves tenant/realm empty; no admitted tenant/realm provenance is inferred.
++T15 remains wait for actual independently authenticated owner-holder/readback
++selection, independent review of the changed adapter, and native restart/lost-
++receipt acceptance. Existing task metadata, owner gates and historical reviews
++are unchanged.
+ 
+ ## T16 — Select and review the actual machine descriptor composition
+ 
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/.custodian-brief.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/.custodian-brief.md
new file mode 100644
index 00000000..ccdbe126
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/.custodian-brief.md
@@ -0,0 +1,91 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — net-kingdom
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 09:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Publish the NetKingdom emission-cadence security profile
+Progress: 5/6 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ► Bind and hand off the published contract  `e3fbc8b8`
+
+### Register Playwright human and agent consumers through governed identity delivery
+Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
+
+**Open tasks:**
+- ! Verify issuer and real consumer acceptance  `5a3aaf57`
+  *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
+- ► Deliver custody integration and guarded registration activation  `a9dadd07`
+
+### Remove bootstrap secret output and verify separated recovery custody
+Progress: 26/38 done  |  workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
+
+**Open tasks:**
+- ! Accept remaining recovery and caller evidence and close the G08 handoff  `d68cd4d3`
+  *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
+- ! Resolve historical credential and configuration-preserving rotation dispositions  `3ea6bf00`
+  *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
+- ! Verify current caller and provider admission at their actual boundaries  `77aa42be`
+  *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
+- ! Prove retained privacyIDEA token decryption and existing-token MFA  `6f8af1a7`
+  *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
+- ! Prove restored KeyCape issuer, policy and consumer continuity  `141dd773`
+  *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
+- ! Prove restored Authelia storage and OIDC continuity  `b47f9975`
+  *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
+- ! Prepare the exact owner-held KeyCape recovery attempt  `56c8d469`
+  *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
+- … and 5 more open tasks
+
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 25/31 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
+
+**Open tasks:**
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+  *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+  *(wait: The next types follow once the first one is proven end to end.)*
+- ! T15 — Define authenticated recovery for lost registration process state  `1b825705`
+  *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
+- ► T14 — Admit governed group rollback against native owner boundaries  `fce95440`
+- · T12 — Prepare NetKingdom-owned attended step adapters  `7ce4eee3`
+- · T16 — Select and review the actual machine descriptor composition  `200bf500`
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/WORK-RECORDS.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/WORK-RECORDS.md
new file mode 100644
index 00000000..4eda3538
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/WORK-RECORDS.md
@@ -0,0 +1,289 @@
+# Work Records — net-kingdom
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
+| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
+| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
+| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
+| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
+| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
+| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
+| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
+| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
+| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
+| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
+| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
+| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
+| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
+| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
+| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
+| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
+| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
+| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
+| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
+| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
+| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
+| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
+| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
+| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
+| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
+| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
+| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
+| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
+| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
+| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
+| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
+| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
+| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
+| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
+| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
+| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
+| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
+| intake | NET-IN-0001 | open | — | intakes/intakes.md |
+| intake | NET-IN-0002 | open | — | intakes/intakes.md |
+| intake | NET-IN-0003 | open | — | intakes/intakes.md |
+| intake | NET-IN-0004 | open | — | intakes/intakes.md |
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-07-02.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-07-02.md
new file mode 100644
index 00000000..66e748e1
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-07-02.md
@@ -0,0 +1,51 @@
+---
+id: NK-WP-ADHOC-2026-07-02
+type: workplan
+title: "Ad Hoc Tasks — 2026-07-02"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: net-kingdom
+created: "2026-07-02"
+updated: "2026-07-02"
+state_hub_workstream_id: "a9177c57-3f48-5d32-aa04-d1822fb86d47"
+---
+
+# Ad Hoc Tasks — 2026-07-02
+
+## Fix creds-bootstrap-agent Phase 0 dry-run on machines without the age key
+
+```task
+id: NK-WP-ADHOC-2026-07-02-T01
+status: done
+priority: low
+state_hub_task_id: "16053545-ed7f-576f-81e0-7095b62a0a1e"
+```
+
+`--dry-run` previously aborted silently in Phase 0 on any machine without
+`~/.config/sops/age/keys.txt`: key generation is correctly skipped in dry-run,
+but the subsequent public-key read (`grep` on the missing file) killed the
+script under `set -e`, so no later phase could be exercised.
+
+Fix: when the key file is absent in dry-run, continue with a placeholder
+recipient and a clear notice instead of dying; live runs without a key still
+fail hard. Verified: full `--dry-run` now traverses Phase 0 through Phase 10
+including the new Phase 7b OpenBao hook (NET-WP-0020-T02) on a machine with
+no age key.
+
+## Fix broken check-secrets Make target (unescaped `$`)
+
+```task
+id: NK-WP-ADHOC-2026-07-02-T02
+status: done
+priority: medium
+state_hub_task_id: "d86d474c-d6ff-57ed-a111-d10f674cb9e4"
+```
+
+`make check-secrets` failed with a bash parse error ("unexpected EOF while
+looking for matching `'`"): the trailing `grep -v '/$'` used a single `$`,
+which make expanded before bash saw it. Escaped to `$$`. Verified:
+`make check-secrets` passes again ("All secrets/ files appear SOPS-encrypted").
+Pre-existing bug, unrelated to NET-WP-0020; found while running the final
+checks for that workplan.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-14.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-14.md
new file mode 100644
index 00000000..91a3ea1a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-14.md
@@ -0,0 +1,70 @@
+---
+id: NK-WP-ADHOC-2026-08-14
+type: workplan
+title: "Close NK-WP-0025 residuals"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-14"
+updated: "2026-08-14"
+state_hub_workstream_id: "d9c4de99-ab79-5238-afe5-c4c77204758c"
+---
+
+# NK-WP-ADHOC-2026-08-14 - NK-WP-0025 residual closeout
+
+## Reconcile Coulomb Social Case B residual records
+
+```task
+id: NK-WP-ADHOC-2026-08-14-T01
+status: done
+priority: medium
+state_hub_task_id: "9968795f-bfc8-5e3e-8b1e-37933fc555a3"
+```
+
+Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
+CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT,
+repeat-login, collision, redirect, and assurance evidence.
+
+## Protect the canonical LDAP-DN subject contract
+
+```task
+id: NK-WP-ADHOC-2026-08-14-T02
+status: done
+priority: medium
+state_hub_task_id: "664aff29-2d03-5cbe-a3e0-1c52d160d019"
+```
+
+Add focused regression coverage for the canonical LDAP-DN OIDC subject and
+the reverse normalization used by directory lifecycle and password setup.
+
+## Persist the audit-core multi-tenant sender scope
+
+```task
+id: NK-WP-ADHOC-2026-08-14-T03
+status: done
+priority: high
+state_hub_task_id: "000e4708-6ef5-550b-9191-f914bdfcd255"
+```
+
+Move the live `user-engine` sender registry from its manually minted Secret to
+the authoritative OpenBao/ExternalSecret path with source-bound write-only
+scope and `tenants: ["*"]`, without reading or logging its token.
+
+2026-08-14 probe: the live Secret has the correct redacted scope, but
+`platform/workloads/audit-core/senders` does not exist. ClusterSecretStore
+`openbao-audit-core` is present and can read only that exact path. The current
+workstation OpenBao identity returns 403 and credential routing exposes no
+resolvable write grant. Completion therefore waits for a short-lived
+platform-admin OpenBao session to perform the documented wrapped migration;
+the temporary probe ExternalSecret was removed.
+
+Done 2026-08-14: after an attended KeyCape/MFA `platform-admin` login, the
+existing registry was streamed directly from Kubernetes to OpenBao without
+printing or staging it. OpenBao created version 1; ExternalSecret
+`audit-core-senders` became `SecretSynced` and owns the derived Secret. Its
+base64 checksum remained
+`dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb`, proving
+the migration did not change the live document. The audit-core rollout
+completed and `/readyz` returned durable `archive` custody.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-23.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-23.md
new file mode 100644
index 00000000..21f20d06
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-08-23.md
@@ -0,0 +1,33 @@
+---
+id: NK-WP-ADHOC-2026-08-23
+type: workplan
+title: "Ad Hoc Tasks — 2026-08-23"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-23"
+updated: "2026-08-23"
+state_hub_workstream_id: "b3abc407-1fd0-58c4-9d8d-2c003ae6f1c9"
+---
+
+# Ad Hoc Tasks — 2026-08-23
+
+## Advance the canonical audit-core E level after adversarial evidence
+
+```task
+id: NK-WP-ADHOC-2026-08-23-T01
+status: done
+priority: high
+state_hub_task_id: "997a696b-1e07-5310-8d22-412eb608cca2"
+```
+
+Updated the Tenancy Posture §5 worked example from `E1` to `E2` after
+audit-core published bounded adversarial evidence for both tenant-filtered
+paths. The canon text names run `WH-ENG-20260822-AUDIT-E2-03`, preserves the
+claim's limited meaning, and records the facility freshness review deadline of
+`2026-08-23T22:10:25Z` rather than presenting the result as timeless proof.
+
+Verification validates audit-core's declaration against the canonical schema,
+runs the tenancy-posture unit suite, and checks the repository diff.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-03.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-03.md
new file mode 100644
index 00000000..360faf21
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-03.md
@@ -0,0 +1,29 @@
+---
+id: NK-WP-ADHOC-2026-10-03
+type: workplan
+title: "Review Emergent Security 0.2.1 orientation boundary"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: net-kingdom
+created: "2026-10-03"
+updated: "2026-10-03"
+state_hub_workstream_id: "a7999e06-b102-5e99-b179-4b19dffac6f9"
+---
+
+## Complete owner-scoped documentary review
+
+```task
+id: NK-WP-ADHOC-2026-10-03-T01
+status: done
+priority: medium
+state_hub_task_id: "9849707d-11d0-568a-b902-0cf5bcc18850"
+```
+
+Evidence: docs/evidence/2026-10-03-emergent-knowledge-021-review.md. The user authorized repository workers to review the exact
+0.2.1 release for EMERGENT-WP-0002. Review and feedback are complete within
+this owner's published boundaries. No policy or operational authority changed;
+no authenticated human assent asserted. Existing decision
+d20a9750-2b29-534e-8227-fb866581a6ca and EMERGENT-WP-0002-T02/T08/T09 retain
+pending acceptance/publication/pilot gates; this record does not duplicate them.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-10.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-10.md
new file mode 100644
index 00000000..7d350c27
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-10.md
@@ -0,0 +1,30 @@
+---
+id: NK-WP-ADHOC-2026-10-10
+type: workplan
+title: "Follow the access-engine CLI rename"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: claude-code
+topic_slug: net-kingdom
+created: "2026-10-10"
+updated: "2026-10-10"
+state_hub_workstream_id: "341b61a1-9e64-5d54-ae4e-a130abc6b960"
+---
+
+## Replace `./cmd/flex-auth` with `./cmd/access-engine`
+
+```task
+id: NK-WP-ADHOC-2026-10-10-T01
+status: done
+priority: medium
+state_hub_task_id: "ac0c45ab-74fe-5ed3-8130-416ea111e07c"
+```
+
+access-engine renamed its CLI (FLEX-DEC-2026-020, access-engine 0ced299,
+message `e2f1aac9`): `./cmd/flex-auth` is now a stub that exits 2. The
+protected-system runbook pack and tutorial now call `go run ./cmd/access-engine`
+(subcommands and flags unchanged), and the tenant-engine README no longer lists
+`cmd/flex-auth` among the unchanged runtime names. Runtime names (namespace,
+Service DNS, audience, chart, OCI package) stay `flex-auth` until FLEX-WP-0036.
+`make runbooks-validate` passes; historical records are left as they were.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-11.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-11.md
new file mode 100644
index 00000000..94059eb7
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-11.md
@@ -0,0 +1,347 @@
+---
+id: NK-WP-ADHOC-2026-10-11
+type: workplan
+title: "Review bounded security doctrine and catalogue exception proposals"
+domain: infotech
+repo: net-kingdom
+status: finished
+flavor: planning
+owner: codex
+topic_slug: netkingdom
+created: "2026-10-11"
+updated: "2026-10-11"
+related: [GH-WP-0004]
+state_hub_workstream_id: "930ae9b3-4769-57ce-bb77-ba2a997f653e"
+---
+
+## Review exact requested successor-canon amendment without publication
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T01
+status: done
+priority: medium
+state_hub_task_id: "9dd7fb12-1ca4-5fd5-94e7-a75dd3e00939"
+```
+
+Source-owner review only of GH-WP-0004-T06-r1, exact proposal SHA256
+08bc78a29c2b67cec0aafba993fb2d25312b629ecccb81458980baafe38e566a.
+Reviewed against NetKingdom INTENT, accepted v0.8, current working companion,
+GH012/014/017/021/024 and InformedDecision's requested row/event inventory.
+Approved technical compatibility for separate founder disposition and proposed
+successor publication review; no standard/case acceptance, founder decision,
+live publication, runtime conformance or completion of GH-WP-0004-T06/INFD-IN-0007
+is asserted. Review and exact sources are retained in docs/reviews/.
+
+## Review the exact one-application maintenance exception source
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T02
+status: done
+priority: high
+state_hub_task_id: "60c1a740-75ac-56f8-bee8-905e7d236460"
+```
+
+NetKingdom-only source-owner review of applied refined nine-file User Engine
+maintenance candidate manifest0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7.
+Reviewed canonical one-app/client/system facts, truthful exception attribution,
+source/hash/native-clock/single-use boundaries and retained-event recovery limits.
+Technical agreement for separate exact founder disposition; no human approval,
+runtime go, catalogue write, default role/grant or normal PDP bypass permission
+is inferred. The fresh User Engine owner supplies its distinct review; this
+worker signs only the established NetKingdom owner role. Exact review/sources
+are retained in docs/reviews/.
+
+## Review the exact Forgejo consumer ESO successor source
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T03
+status: done
+priority: high
+state_hub_task_id: "03292a62-1803-5bdf-9f19-f2c8fa7b61db"
+```
+
+NetKingdom-only source-owner review of the frozen 17-path Forgejo consumer ESO
+successor proposal. Initial manifest c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb
+contained a misleading acknowledged-type risk note; the requester corrected it
+and retained that original revision. Final manifest
+271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279 independently
+verified, including the sole risk-note amendment, all 17 paths, seven current
+source pins, native source validators, identical full render regeneration and
+exact preservation of the original five structural objects plus a sixth role.
+Technical source agreement only: SecurityCaseTypes §6 requires a new founder
+informed-decision acknowledgment for this authentication/materialization change;
+current type/case1.1, historical CCR42 and all native state remain unchanged.
+No type/case acknowledgment, binding admission, materialization, credential
+grant or live delivery is authorized. Exact review and evidence retained in
+docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-review.*.
+
+## Receive the accepted bounded doctrine handoff and assemble proposed source
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T04
+status: done
+priority: high
+state_hub_task_id: "c867858d-dda6-504a-9eac-f53b8ece6e31"
+```
+
+Received exact GH-DEC-2026-025 / GH-WP-0004-T06 source-owner handoff after
+confirmed person ACCEPT d90c899b-f25c-4e66-a003-808ee5b1324f at2026-10-11T01:46:25Z
+of proposal08bc78a29c2b67cec0aafba993fb2d25312b629ecccb81458980baafe38e566a.
+Assembled the exact bounded §3.4/§4 candidate in proposed v0.9 only; accepted
+v0.8 stays byte-identical/operative. Reviewed full paragraph/row equality against
+both immutable proposal and handoff, native receipt scope, unchanged other
+normative sections and retained Staff/evidence limits. No whole v0.9 acceptance
+or serving/deployment is inferred. Live successor adoption/publication is
+retained first as NET-IN-0004; INFD-IN-0007 stays open pending accepted voice.
+Gate House handoff completion is distinct from this source-owner's outstanding
+standard adoption. No finished INFD implementation plan is reopened.
+
+## Review the final nineteen-path Forgejo consumer ESO source revision
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T05
+status: done
+priority: high
+state_hub_task_id: "4903132f-3815-502d-bcf8-30d7a244f62d"
+```
+
+Final narrow NetKingdom source-owner review of manifest
+5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431.
+Retains T03 and its earlier271 proposal review as history, not current exact
+acknowledgment. Verified all19 staged hashes, seven current source pins, proposed
+type/case admission refusal, identical c0afd render and independent projections.
+Both prior271 counterexamples reproduced: wrong consumer target and missing
+created-only issued-token recovery guards. Corrected builder derives forgejo,
+preserves KeyCape output and requires owner revocation or verified expiry,
+created-only preservation and no recovery login/remint. Fresh Mason/Platform
+owner44-test reports checked; no native proof inferred. Proposed type/case
+need fresh founder acknowledgment under §6, source rebundle/reconciliation and
+existing per-owner/native acceptance. No role/grant/materialization/runtime
+change or first-case completion. Exact final review/sources retained in
+docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.*.
+
+## Review the source-only successor acknowledgment human packet
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T06
+status: done
+priority: high
+state_hub_task_id: "cee400f6-f1a6-5ee3-8fde-68bfb4c9cbf4"
+```
+
+NetKingdom-only source-owner review of exact26-path packet
+eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5, stable proposal
+NK-FORGEJO-TYPE12-SOURCE-20261011-R1, memo1, submission5d36e27de6161e0c80c0590a99a4d47c998f673aacf289d7a6b46adfe510c6e7.
+All hashes,20 documents, applied19source attachments, typed intake and tamper/
+version/prebound-approval negatives verified. Changes requested to make the
+separate source-reference acceptance receipt mandatory while canonical1.2case
+stays proposed: schema permits accepted-case shape, but normalsemantic admission
+rejects its acknowledged/unimplemented type under canon§4/5. No new founder
+acknowledgment, native publication or status change has occurred. Existing
+NK0048/project work retains recording/review followthrough; no duplicate plan.
+Exact review/proposed correction and independent proof retained in docs/reviews/.
+
+T06 same-trial refinement review: exact completed32-path packet
+330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c resolves the
+recording concern with mandatory separate design receipt and canonical case
+remaining proposed. Independent full-package validator and22 tests passed,
+including three missing-package regressions; schema/typed20-doc intake and
+three refusal guards passed at233429bytes. Post-ack isolated shape/render proof
+keeps canonicalcaseproposed, ordinary admission blocked and executionfalse.
+Original eeb changes-requested review and prepackage12ce failures remain history,
+not new scored successes. Final source agreement is separate receipt only;
+no actual founder acknowledgment, native intake, acceptance or runtime change.
+
+2026-10-11T06:47:39Z source-recording preparation, same T06 trial: latest native
+outcome confirms nonstale person ACCEPT of exactmemo1, approval
+8e9332c8-754a-420c-b8b7-445cb4fe6765, disposition
+disp-315d54ad-20f1-40e6-862c-6c7d2e8f0ea8. Prepared external acknowledgment
+receipt and complete acknowledged1.2 package in explicit version source root
+security-case-type-revisions/1.2, changing type semantic status only. Independent
+fullvalidator and22 adapted-source tests pass; schema/versionload/render checks
+pass and normalcase admission remains refused. Packet-bound proposed sources
+and defaultcanonical1.1 package/case stay byte-identical. Separate Apps design
+receipt transcribes the actual human source scope, not an agent ownerreview or
+canonicalcase acceptance. Requesting coordinator records actual foundergo; no
+worker native/credential/grant action. Canonical1.2case remains proposed without
+acceptance; implementation followthrough remains existing NK0048-T06/project
+owner tasks. No new trial, taskT07, broad plan or whole-workplan finish.
+
+Explicit version-selection source followthrough review, same completed owner T06
+anchor: reviewed exact six-file source manifest
+88238f29ebeceee36f6f6e77bb19cb43837b5bc03bce21c16acc50399b302084.
+Independent43 validator/selection tests and22 acknowledged1.2 package compatibility
+tests pass in isolated source snapshot. No mappings preserve default1.1; explicit
+1.2 loads only its selected exact root with no fallback/discovery, and mismatched
+case/type references, duplicate mappings/YAML keys and selected symlinks refuse.
+Both types remain acknowledged/unimplemented; historical accepted1.1 case and
+its normal refusal remain unchanged. Preparation digests stay e64b56e4.../c0afd557...
+and executionfalse. Canonical/acknowledgment hashes verified unchanged; source
+loader selection confers no case admission, native adapter/global verifier,
+materialization, grant or implemented status. Existing NK0048-T06 remains wait.
+No new source-ack trial or broad implementation plan is created.
+
+## Independently review the frozen KEY39 lifecycle v2 source
+
+```task
+id: NK-WP-ADHOC-2026-10-11-T07
+status: done
+priority: high
+state_hub_task_id: "3b6d52b2-b011-54da-a1e8-4c2aef7a94ae"
+```
+
+Completed NetKingdom-only offline source-owner review preparation of exact
+KEY-WP-0039-T02/attended-lifecycle-v2 manifest
+6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed.
+The source and tests, runtime CAS, temporary registration/env/Secret isolation,
+two single-replica Recreate restarts, captured output, normal cleanup and separate
+hard-interruption recovery were inspected against NetKingdom INTENT.
+Supplied tests and independent synthetic refusal checks are retained with the
+formal owner review under the temporary source-review stage. This completed
+local review task is distinct from KEY39 T02 and all native owner obligations.
+No founder decision, deployment, credential access, Secret read, grant, live
+acceptance or task closure in other repositories is claimed.
+
+T07 same-trial v3 refinement review: independently reviewed exact manifest
+fbc31fda2b6194747547b9fbe876095914c3d53231c79abd43a010dbb3273efa.
+Both v2 deadline counterexamples now refuse; a real elapsed timer interrupts
+slow HTTP body reads and restores signal state. Thirty-nine supplied and fifteen
+independent checks pass, including a retained new failure reproduction: final
+temporary Secret deletion bypasses the aggregate cleanup deadline through an
+unguarded subprocess call. Changes requested for that exact source path only;
+v2 changes-requested evidence and frozen stages stay unchanged. No native
+authority, owner acceptance or KEY39 task closure is inferred.
+
+
+T07 same-trial final v4 source refinement review: exact frozen manifest
+d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8
+routes the exact temporary Secret deletion through guarded k. The v3 expired
+cleanup reproduction now makes zero native calls; a real slow-delete timer is
+clipped to remaining cleanup time. Both earlier v2 counterexamples now refuse,
+late full OpenBao acceptance is self-revoked privately before failure, partial
+acceptance stays unknown, and aggregate cleanup does not renew. Forty-one
+supplied lifecycle tests, seventeen unchanged-runner tests and seventeen
+independent checks pass. NetKingdom source agreement only; earlier unsuccessful
+reviews and immutable sources remain history in this same trial. Native token
+production, runtime authority, quiet-window/headroom, execution, revocation/
+cleanup and other owners' task closure remain separate obligations.
+
+T07 same-trial v5 exceptional HTTP-close refinement review: frozen manifest
+d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285
+retains NetKingdom's prior v4 agreement and Platform's distinct v4
+changes-requested finding as history. Exceptional response close now has one
+20 ms abort cap clipped to positive original request time and the same
+nonrenewable aggregate cleanup deadline; expired aggregate performs no close.
+Independent early-read and timed-read failure/slow-close checks, known accepted
+session revocation despite normal-close error, signal restoration, value-free
+unknown outcomes and prior deadline/delete/recovery guards pass. Forty-six
+supplied lifecycle tests, seventeen unchanged-runner tests and twenty-one
+independent checks pass. NetKingdom exact source agreement only; same trial,
+no new task, native authority, credential access, runtime acceptance or closure.
+
+T07 same-trial node-route source followthrough: prepared exact successor
+manifest 23a972abc5175e121e594726d2b7f7a28c62109253f58f12623eaf2e5564a035 from unchanged published/frozen v5. Source inspection
+confirms the named OpenBao bridge binds workstation loopback, not node loopback;
+node Pod DNS/reachability is unobserved. Proposed founder-held bounded node-local
+port-forward of existing openbao/openbao-ui-gateway includes targeted teardown.
+A public-only route diagnostic and strict health identity digest now gate execute
+before protected/native reads and again before temporary mutation; recovery
+checks first as well. Forty-six retained lifecycle, eight new route, twenty-one
+retained independent and seventeen unchanged-runner tests pass offline.
+No tunnel, native health probe, credential/Secret read or mutation ran. Current
+source agreement is only NetKingdom's; fresh independent Platform/KeyCape
+acknowledgments and exact founder route/native authority remain prerequisites.
+Same completed T07, all previous source/review bytes intact, no new workplan.
+
+T07 same-trial v7 private-input sequencing correction: exact successor
+manifest 90aabec336008d7d51e37c04b5ff96ba8ed6630821cca1a4c333d803367247f7 retains immutable v6 source and NetKingdom/Platform
+reviews. V6 health gated native access but main read stdin first; its broader
+pre-private-input description was incorrect. V7 main now validates the exact
+source/approval, starts the bounded window and checks pinned public health before
+reading stdin. Execute revalidates source/expiry and preserves that original
+monotonic budget, while retaining health before native access and first mutation.
+Actual main tests prove failed/missing-pin health never consumes stdin; recovery
+remains stdin-free. Forty-six lifecycle, twelve route/main and twenty-one retained
+independent checks pass; unchanged runner remains pinned and previously verified.
+Pre-freeze local refactor/test failures were corrected and retained in validation
+evidence. Source preparation only; no owner checkout changes, native operation,
+credentials, tunnel, health observation or new workplan. Fresh exact independent
+KeyCape/Platform reviews and founder native authority remain required.
+
+T07 same-trial private-producer consumer source review: exact KeyCape proposal
+manifest 239aaac8541ba05e8bba5f9ecdc8b555a02fd9d0ad1762fdfc4d4bae7e4ef463
+reviewed as NetKingdom consumer only. Eighteen supplied and five independent
+synthetic checks pass, including actual partial-write timeout/unknown outcome.
+Changes requested: no child-ready preflight acknowledgement before private pipe
+write, writable stdout-pipe aliases pass FD>=3 guard, and final stat/unlink is
+non-atomic despite precise-inspected-inode removal wording. Exclusive caller
+custody is an assumption, not an authenticated peer or JWT signature proof.
+No KeyCape owner role, existing-client reuse, coding-agent custody admission,
+launcher/transport grant or native readiness is inferred. No private credentials,
+native operation or owner checkout writes occurred; staged v6/v7 remain history.
+
+T07 same-trial v8 bounded private receive correction: exact frozen successor
+manifest 316fd6005cc4cb7fe14ea69a5fd408aed13e6122afef60afd13d97952b27cf4a retains v7 agreement and the subsequent KeyCape
+unbounded-input finding as same-trial history. Complete private JSON receive is
+now binary/chunk/65536-byte/15-second capped, clipped to the original remaining
+action window; requires actual EOF, exact two-token object and per-token byte
+limits, checks expiry again before decoding/execute and emits no private errors.
+Actual main real stalled pipe and complete JSON without EOF time out; oversized,
+incomplete and late input refuse before execution. Forty-six lifecycle, twelve
+route/main, seven new receive and twenty-one retained independent checks pass.
+Producer-side exact-child ready acknowledgment still does not exist; child read
+bounds do not authorize early exporter write. Earlier producer changes-requested
+review remains live source feedback. Fresh exact independent KeyCape/Platform
+reviews, producer/launcher handoff and founder native authority remain required.
+No original source/stage/review changed, no owner checkout writes or native/
+credential/Secret/tunnel operation; same completed T07, no duplicate workplan.
+
+T07 same-trial v9 concrete private-ready protocol preparation: exact source
+manifest 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14 follows published v8 while retaining v5/v6/v7/v8 and
+producer v1 consumer-refusal history. Child emits bounded value-free nonce/pin/
+window-bound marker via distinct local inherited pipe only after exact source/
+approval/public-health and before private input; stdio aliases refuse. A node
+wrapper creates that local pipe, launches pinned child/envelope, relays one
+marker on captured SSH control stdout and never reads/copies private stdin.
+No extra FD is forwarded by SSH/Bridge, no marker authenticates authority/peer,
+and the output-suppressed warden lane is explicitly incompatible. Independent
+KeyCape producer/launcher source is coordinated but not yet exact reviewed or
+admitted; it must await marker before loading/consuming files or writing tokens.
+Forty-six lifecycle, twelve route/main, seven receive, nine new ready/wrapper and
+twenty-one retained independent tests pass offline; real pipe timeout/alias and
+actual main ordering checked. No SSH, native child/health/tunnel, credential or
+owner checkout action occurred. Fresh independent KeyCape/Platform reviews,
+trusted founder SSH/launcher/private-file/native admission and real owner
+acceptance remain necessary; same completed T07, no duplicate workplan.
+
+T07 same-trial independent NetKingdom consumer source review of exact KeyCape
+producer V3 manifest 569672ecdb3f1f5b46122183dc3b82e83ff168c07c87db7211ec26bc1ce6184a paired with unchanged Net V9 manifest
+84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14: completed source-only analysis and offline validation;
+changes requested because actual launcher CLI contract FIFO acquisition blocks
+before its preparation timer. V2 also reproduces and is preserved. Thirty-three
+maker tests and nine independent actual local fake-SSH -> real pinned wrapper ->
+real child-main handshake checks pass, with public health and native execution
+explicitly mocked, synthetic unsigned tokens only. Wrong nonce/marker, health
+failure, expired approval and source mismatch perform zero token-file loads;
+quietness failure and real partial pipe delivery retain unknown consumer outcome.
+V3 sticky unknown correction passes. Exclusive same-UID directory custody is
+required; unlink is non-atomic and no zeroization/copy cleanup is proved. Prior
+v5-v8 reviews, V9 own anchor and original producer refusal remain unchanged.
+No KeyCape formal role, authenticated marker authority, native/source admission,
+credential reads, SSH, tunnel, repository writes or workplan closure inferred.
+
+T07 same-trial fresh independent NetKingdom consumer source review of exact
+KeyCape producer V4 manifest d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e paired with unchanged Net V9 manifest
+84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14: completed source-only qualified agreement. Actual
+CLI rejects FIFO/symlink/oversize contracts before private reads, slow main
+acquisition and default caller validation are bounded, and acquisition plus
+launch retain one original preparation deadline. Forty maker tests and thirteen
+independent checks pass, including nine actual local fake-SSH/pinned-wrapper/
+child-main handshake checks with fixture public health and native execution.
+V1 and V3 refusals, V2/V3 FIFO counterexamples, V3 sticky unknown correction,
+v5-v8 histories and V9 own preparation anchor remain unchanged. Exclusive
+same-UID directory custody, admitted pinned owner launcher/SSH host profile,
+private file allowance and exact founder native authorization remain required;
+marker and unsigned claims authenticate neither authority nor issuer. No
+credential read, native command, real SSH, owner checkout write or native/task
+closure occurred. This source agreement does not approve transport or custody.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-16.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-16.md
new file mode 100644
index 00000000..a38773ae
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/ADHOC-2026-10-16.md
@@ -0,0 +1,33 @@
+---
+id: NK-WP-ADHOC-2026-10-16
+type: workplan
+title: "Reconcile recovery capability index with its owner entry"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+created: "2026-10-16"
+updated: "2026-10-16"
+flavor: implementation
+state_hub_workstream_id: "dc9c40f4-930f-545d-8da0-1de5ae29f533"
+---
+
+## Reconcile recovery capability index with its owner entry
+
+```task
+id: NK-WP-ADHOC-2026-10-16-T01
+status: done
+priority: medium
+state_hub_task_id: "489e3fa0-8193-5c08-8c41-27939010d303"
+```
+
+Reconcile only the bootstrap-recovery index summary with the existing authoritative capability entry. Old strict validation passed despite the difference; the reviewed validator refuses it until this correction. No recovery capability, maturity, deployed behavior or owner acceptance is added.
+
+Completed 2026-10-16 under the founder's NetKingdom target implementation demand
+(CUST-WP-0080, TSA-11). Source review and exact before/after native CLI evidence:
+`the-custodian/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/`.
+The current 60-provider cohort has all 70 reviewed IDs exactly once; 3 field
+mismatches across 2 capabilities become zero with the source corrections.
+Native hosted refresh/readback and the accepted Activity/rein schedule remain
+separate gates. No production change, model call, credential access or external
+message was performed.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md
new file mode 100644
index 00000000..ffe7a7ee
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md
@@ -0,0 +1,149 @@
+---
+id: NET-WP-0020
+type: workplan
+title: "OpenBao Unseal Custody Models and SSH Automation Path"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: net-kingdom
+created: "2026-06-17"
+updated: "2026-07-02"
+state_hub_workstream_id: "d6338ac9-797d-4009-8203-4b8dd39010af"
+---
+
+# NET-WP-0020 — OpenBao Unseal Custody Models and SSH Automation Path
+
+**Scope:** Framework for three OpenBao init/unseal custody models; automation-first
+development path; console decision points; downstream hooks for SSH engine and
+host CA automation on greenfield 3-node bootstrap.
+
+**Strategy:** Start with `sops-held-automation` for fast unattended test cycles;
+add `attended-ceremony` and `auto-unseal-transit` with blocking gates as
+production trust increases.
+
+---
+
+## Tasks
+
+### T1 — Custody model canon and console gates
+
+```task
+id: NET-WP-0020-T01
+status: done
+priority: high
+state_hub_task_id: "7040f347-d54a-42ba-a14f-5b0a7e691786"
+```
+
+- [x] `docs/openbao-unseal-custody-models.md`
+- [x] Console: list + select commands; gates block planned models
+- [x] `smooth-bootstrap-guide.md` Step 5 update
+- [x] Makefile targets
+
+### T2 — SOPS-held init/unseal automation hooks
+
+```task
+id: NET-WP-0020-T02
+status: done
+priority: high
+state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"
+```
+
+- [x] SOPS-held init/unseal automation: `sso-mfa/bootstrap/openbao-init-unseal.sh`
+  (`make openbao-init-unseal` / `openbao-init-unseal-dry-run`)
+- [x] Non-secret evidence flags: `openbao_initialized`, `openbao_post_unseal_verified`
+  (emitted on the script's `EVIDENCE` JSON line)
+- [x] Integrate with `make openbao-configure-initial` post-unseal
+  (`OPENBAO_RUN_CONFIGURE_INITIAL=1` chains it; default prints the handoff hint)
+- [x] Wire the helper as an optional phase inside `creds-bootstrap-agent.sh`
+  (Phase 7b, reviewed and approved by Bernd 2026-07-02: runs only when the
+  `openbao` namespace exists, skips when already verified, sets the two
+  `creds-state.yaml` flags, encrypts + commits new init material, and a
+  custody-gate refusal warns without aborting the SSO/MFA bootstrap —
+  dry-run/skip/refusal paths harness-tested)
+- [x] Greenfield live proof: full init→unseal→verify path proven 2026-07-02
+  against a genuinely uninitialized local OpenBao 2.5.5 (kubectl-exec shim,
+  script logic unmodified) — see
+  `history/2026-07-02-openbao-greenfield-init-unseal-proof.md`. The proof
+  caught and fixed a real bug: `bao operator unseal -` does not read stdin;
+  now `bao write sys/unseal key=-` (shares still never in argv/logs). Restart/
+  reseal replay path proven too. The first 3-node rebuild slate re-runs the
+  same script via Phase 7b.
+
+**2026-07-02 (later):** Bernd reviewed the helper design (five safety
+properties incl. the root-token-in-bundle caveat of the sops-held model) and
+approved the Phase 7b wiring as proposed. Applied, `bash -n` clean, all three
+conditional paths verified by harness. Pre-existing note: the agent's Phase 0
+cannot dry-run on machines without the age key — unrelated to this change.
+Remaining T02 item is only the greenfield live proof.
+
+**2026-07-02:** Helper implemented and smoke-tested: dry-run against the live
+cluster passed the custody gate (`sops-held-automation` selected) and read
+`initialized=true sealed=false`; negative tests proved refusal for unselected
+and attended-ceremony models. Init material is written only into
+`secrets/openbao/` for age custody; unseal shares travel stdin-to-stdin and
+never appear in argv or logs.
+
+### T3 — Attended ceremony automation profile
+
+```task
+id: NET-WP-0020-T03
+status: done
+priority: medium
+state_hub_task_id: "34f3d979-a040-49ca-bfcb-35cf17473a06"
+```
+
+- [x] Implement `attended-ceremony` selection path (runbooks + evidence validators)
+- [x] Production profile blocks `sops-held-automation` default
+
+**2026-07-02:** Model selectable in the console; runbook at
+`docs/openbao-attended-ceremony-runbook.md`; non-secret ceremony record
+template + `validate-openbao-ceremony-record` validator (refuses secret
+markers/placeholders). New `deployment_profile` metadata (`lab`/`production`,
+`select-deployment-profile`): production blocks `sops-held-automation` in
+selection, status gates, and `openbao-init-unseal.sh`. Console refuse-live-init
+boundary unchanged. Covered by console test suite (14 passing) + CLI smoke.
+
+### T4 — Auto-unseal transit profile
+
+```task
+id: NET-WP-0020-T04
+status: done
+priority: medium
+state_hub_task_id: "54ab6505-c13b-4f63-8c94-07dd202de90a"
+```
+
+- [x] `railiance-platform` Helm seal stanza for transit/KMS
+- [x] Console gate + evidence for `auto-unseal-transit`
+
+**2026-07-02:** Commented-out `seal "transit"` stanza (disabled by default;
+token via `extraSecretEnvironmentVars`, never Git) in
+`railiance-platform/helm/openbao-values.yaml` plus an "Auto-Unseal via Transit
+Seal" section in `railiance-platform/docs/openbao.md` (enable → `-migrate` →
+pod-restart proof). Console: model selectable; init gate stays blocked until
+`openbao_transit_seal_configured` and `openbao_auto_unseal_verified` are set.
+Live transit/KMS provisioning is future ops work on the HA rebuild, gated by
+that evidence.
+
+### T5 — SSH engine + host CA automation (cross-repo)
+
+```task
+id: NET-WP-0020-T05
+status: done
+priority: high
+state_hub_task_id: "399e82ca-6551-4020-8db5-c78076e75cfc"
+```
+
+- [x] `railiance-platform`: `openbao-configure-ssh` declarative script + Makefile targets
+- [x] `railiance-infra`: `bootstrap-ssh-ca` role + `ssh_principals.yaml` inventory
+- [x] Live apply: OpenBao SSH engine + roles + `warden-sign` on Railiance (2026-06-18)
+- [x] Live apply: `bootstrap-ssh-ca` on CoulombCore + Railiance01
+- [x] Close `ops-warden` WP-0008 T2 verification gate
+
+---
+
+## See also
+
+- `history/2026-06-17-openbao-ssh-custody-and-bootstrap-assessment.md` — state + concepts (read before T5)
+- `ops-warden/workplans/WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md`
+- `railiance-platform/docs/openbao.md`
\ No newline at end of file
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md
new file mode 100644
index 00000000..6e55c842
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md
@@ -0,0 +1,190 @@
+---
+id: NK-WP-0009
+type: workplan
+title: NetKingdom Security Pattern Tutorials
+domain: infotech
+repo: net-kingdom
+status: finished
+flavor: implementation
+owner: codex
+topic_slug: netkingdom
+planning_priority: medium
+planning_order: 9
+created: 2026-05-17
+updated: "2026-10-03"
+depends_on:
+  - NK-WP-0008
+state_hub_workstream_id: "d4d02dbf-3974-502d-8b87-b776fc63e17e"
+---
+
+# NK-WP-0009 - NetKingdom Security Pattern Tutorials
+
+## Goal
+
+Build practical tutorials that show operators and developers how to
+implement canonical NetKingdom security architecture patterns in
+NetKingdom-enabled IT infrastructures.
+
+Where NK-WP-0008 is the pattern library, this workplan is the hands-on
+path: runnable examples, checklists, commands, manifests, verification
+steps, and failure-mode exercises.
+
+## Context
+
+The platform needs more than architecture statements. A new deployment
+should be able to answer:
+
+- How do I issue identity tokens in lightweight mode versus expanded
+  mode?
+- How do I ask flex-auth for a resource decision?
+- How do I vend temporary object-storage credentials?
+- How do I deploy OpenBao and avoid secret zero traps?
+- How do I use short-lived SSH certificates for agents and automations?
+- How do I verify audit records and break-glass behavior?
+
+Tutorials turn canonical patterns into repeatable implementation
+practice without forcing every application repo to rediscover the same
+steps.
+
+## Scope
+
+In scope:
+
+- tutorial structure and style guide
+- runnable or copy-pasteable examples
+- local/dev and production variants where appropriate
+- verification and rollback steps
+- integration references to key-cape, flex-auth, ops-warden,
+  ops-bridge, railiance-platform, and artifact-store
+
+Out of scope:
+
+- deploying live services directly from this repo
+- replacing repo-specific operator runbooks
+- hiding provider-specific security differences behind one generic
+  command
+
+## Create the tutorial template
+
+```task
+id: NK-WP-0009-T01
+status: done
+priority: high
+state_hub_task_id: "3c6824a0-39e6-51f5-b46f-5861a9375439"
+```
+
+Create a tutorial template with prerequisites, architecture context,
+commands, manifests, verification, rollback, threat checks, and
+cross-repo ownership notes.
+
+## Demonstrate temporary object credentials
+
+```task
+id: NK-WP-0009-T02
+status: done
+priority: high
+state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"
+```
+
+Write the first tutorial: "Vend temporary S3 credentials from a
+NetKingdom identity token", covering key-cape/Keycloak identity,
+flex-auth authorization, object-store STS exchange, and SDK consumer
+configuration.
+
+**Drafted 2026-09-29 as a native pack**: `runbooks/object-storage-sts/` (`nk.object-storage-sts`, validates,
+`unexercised`) with an offline validator, `check_sts.py`, encoding the request, response, deny and `credential_process`
+contract from `docs/object-storage-sts-credential-vending.md`. The offline checks were run and pass, including the
+refusals (TTL over one hour, wildcard action). No credential-vending service is deployed (the baseline is NK-WP-0007),
+so the live stage records "not deployed" honestly. The task closes on a run receipt from the UI, like T03-T05.
+
+## Document the existing OpenBao operating path
+
+```task
+id: NK-WP-0009-T03
+status: done
+priority: high
+state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"
+```
+
+Write "Deploy OpenBao as the canonical secrets manager for a
+NetKingdom-enabled Railiance platform", linking to the Railiance
+Platform workplan and covering auth methods, secret engines, CSI/ESO
+integration, leases, unseal, backup, and break-glass.
+
+## Document SSH certificates and tunnels
+
+```task
+id: NK-WP-0009-T04
+status: done
+priority: medium
+state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"
+```
+
+Write "Use short-lived SSH credentials for admins, agents, and
+automations", using ops-warden and ops-bridge as the reference
+implementation.
+
+## Integrate a protected flex-auth consumer
+
+```task
+id: NK-WP-0009-T05
+status: done
+priority: medium
+state_hub_task_id: "c380ef19-4bc2-5ade-b127-baf18c64bf35"
+```
+
+Write "Add a protected system to flex-auth", covering resource
+manifests, action vocabulary, claim envelopes, policy packages,
+decision envelopes, and delegated PDP options.
+
+## Verify the tutorial outcomes
+
+```task
+id: NK-WP-0009-T06
+status: done
+priority: medium
+state_hub_task_id: "5b6a1670-a283-56e9-892e-ef8b91194a7b"
+```
+
+Add tutorial verification fixtures or checklists so each tutorial has a
+clear "done when" outcome and does not become prose-only guidance.
+
+## Acceptance Criteria
+
+- Tutorials are grouped under a stable docs path with a repeatable
+  format.
+- Each tutorial maps back to one or more NK-WP-0008 patterns.
+- Tutorials name the owning repo for every concrete implementation
+  step.
+- Tutorials include verification and rollback guidance, not just happy
+  path commands.
+
+## Infrastructure review — 2026-09-28
+
+Keep this plan in backlog, with the first implementation slice T01 + T03 +
+T04 + T06: document the paths already operated and capture safe verification
+and recovery outcomes. OpenBao is already deployed and private; T03 should
+teach consumption, attended access and recovery, with greenfield deployment
+kept as an isolated lab exercise. Use the named `openbao-ui-railiance01`
+tunnel and owner runbooks, not a public Bao URL or copied runtime manifest.
+
+T02 is conditional on an owner-backed object-store STS issuer and refusal/lease
+proof; ADR-0008 is architecture, not evidence that the endpoint is live. T05
+must include projected caller identity, audience, binding and unauthorized
+caller rejection: all six live consumers now enforce caller authentication.
+Use accepted IAM v0.3 and owner package declarations under ADR-0015. T06
+requires executable safe fixtures or repeatable outcome checks; never teach
+operators to apply the stale tenant-engine reference YAML.
+
+Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
+
+## Rehearsal receipts — 2026-10-02
+
+Bernd ran three packs cleanly in project `nk-rehearsal` (rehearsal environment, no deviations); the engine derives `rehearsed`:
+`nk.object-storage-sts` (run 20261002-223449-dfa0b3, T02), `nk.ssh-certificates` (20261002-225810-0d8ab7, T04; first `sign` attempt failed
+and was retried with the missing `WARDEN_CONFIG`), `nk.openbao-operating-path` (20261002-234245-d73656, T03). T02, T03 and T04 are done.
+Limits: the S3 pack proves the contract offline, not a live service; the SSH tunnel stage is recorded not proven and the rehearsal config
+bypasses the flex-auth policy gate; the OpenBao pack is read-only. T05 (`nk.protected-system-flex-auth`) has no run yet.
+
+`nk.protected-system-flex-auth` (run 20261002-235239-c46227) completed cleanly in `nk-rehearsal`, so T05 is done and all four tutorials are
+rehearsed packs. The markdown verifier is retired (NK-WP-0044-T06).
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0011-enterprise-federation-saml.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0011-enterprise-federation-saml.md
new file mode 100644
index 00000000..f6dc921d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0011-enterprise-federation-saml.md
@@ -0,0 +1,385 @@
+---
+id: NK-WP-0011
+type: workplan
+title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
+domain: infotech
+repo: net-kingdom
+status: active
+flavor: residual
+owner: worsch
+topic_slug: netkingdom
+created: "2026-05-20"
+updated: "2026-10-03"
+state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07"
+depends_on:
+  - NK-WP-0003
+  - NK-WP-0004
+  - NK-WP-0006
+supersedes_tasks:
+  - NK-WP-0001-T05
+  - NK-WP-0001-T06
+  - NK-WP-0001-T07
+  - NK-WP-0001-T08
+---
+
+# NK-WP-0011 — Enterprise Federation & SAML (Expanded-Mode Keycloak)
+
+> Extracted from NK-WP-0001 (T05–T08, the deferred Keycloak path) and
+> refined against where net-kingdom actually stands today: a deployed
+> KeyCape lightweight stack, an OpenBao runtime-secret authority, and a
+> recursive platform/tenant authorization model. This is **expanded
+> identity mode** in the architecture (`docs/platform-identity-security-architecture.md`).
+
+## Goal
+
+Stand up **Keycloak as an identity broker** that federates upstream
+enterprise identity providers (Microsoft Entra ID / Azure AD via OIDC,
+on-prem Active Directory via LDAP, and generic SAML 2.0 IdPs) and issues
+**NetKingdom IAM Profile-conformant** tokens downstream — without
+displacing flex-auth as the authorization decision point or breaking the
+recursive platform/tenant boundary.
+
+This is the answer to the long-standing open question
+*"when does the platform switch from key-cape lightweight mode to Keycloak
+expanded mode?"* — expanded mode exists **specifically** to onboard
+identities that originate in an external enterprise IdP, which the
+lightweight Authelia + LLDAP stack cannot broker.
+
+## Why this is not just "resume NK-WP-0001"
+
+NK-WP-0001 assumed a greenfield: bootstrap Vault, build PostgreSQL, treat
+Keycloak as the internal user store. None of those assumptions hold now:
+
+| NK-WP-0001 assumption | Current reality | Effect on this plan |
+|---|---|---|
+| HashiCorp Vault, bootstrapped from KeePassXC | **OpenBao** is the runtime secret authority (NK-WP-0006); SOPS/age + agent bootstrap exist (NK-WP-0004/0005) | Keycloak DB + admin secrets come from OpenBao via ESO; no new vault bootstrap |
+| PostgreSQL built from scratch | CloudNativePG running on RAILIANCE01 (NK-WP-0003) | Admit a database consumer through current platform owners; prove backup/restore |
+| Keycloak is the internal source of truth (D2 hybrid) | KeyCape lightweight stack is the *deployed* IAM Profile issuer | Keycloak is a **broker/federation front-end**, not the primary user store |
+| Authorization via Keycloak Authorization Services | flex-auth + Topaz is the canonical PDP (ADR-0006) | Keycloak AuthZ Services is at most an optional adapter, never canonical |
+| Single-tenant Coulomb deployment | Recursive `tenant:platform` vs `tenant:coulomb` model (NK-WP-0006) | Evaluate realm-per-tenant; tenant admins must not receive platform-root |
+| MFA solely via privacyIDEA provider JAR | privacyIDEA deployed *and* upstream IdPs carry their own MFA | MFA assurance source becomes a decision, not a default |
+
+## Architecture
+
+```text
+        Enterprise IdPs (upstream)
+   Entra ID (OIDC)   AD (LDAP)   SAML 2.0 IdP
+        │              │              │
+        └──────────────┼──────────────┘
+                       ▼
+                 [ Keycloak ]  expanded-mode broker
+                       │   realm-per-tenant candidate; IAM Profile issuer
+                       │   secrets ← OpenBao (ESO)
+                       │   MFA ← privacyIDEA *or* upstream assurance
+                       ▼
+        NetKingdom IAM Profile token (OIDC/PKCE)
+                       │
+                       ├──► applications (depend on the Profile, not the provider)
+                       └──► flex-auth / Topaz  ── authorization decision (PDP)
+
+   coexists with: KeyCape lightweight issuer (kc.coulomb.social)
+```
+
+Keycloak answers identity (who, how authenticated, coarse claims,
+assurance). It does **not** answer resource authorization — that stays in
+flex-auth (ADR-0006). It does not store runtime secrets — those stay in
+OpenBao.
+
+## Scope
+
+In scope:
+
+- decision record for expanded-mode adoption: trigger, federation
+  topology (broker vs SAML SP), realm isolation model, and coexistence
+  with the KeyCape lightweight issuer
+- owner-packaged Keycloak image (privacyIDEA provider JAR only if selected
+  and verified compatible) and managed deployment on railiance01
+- upstream federation: Entra ID (OIDC), AD (LDAP), generic SAML 2.0 IdP
+- claim mapping to the NetKingdom IAM Profile (issuer, audience, subject,
+  groups, tenant, assurance evidence) and IAM Profile conformance checks
+- MFA / assurance source decision and enforcement of step-up for
+  privileged actions
+- recursive tenancy: realm-per-tenant, platform-root guardrails, and the
+  flex-auth/Topaz authorization boundary
+- backups, DR, break-glass, monitoring, and audit shipping for the broker
+
+Out of scope:
+
+- replacing flex-auth/Topaz with Keycloak Authorization Services
+- migrating the deployed lightweight stack off KeyCape (coexistence only)
+- application-side OIDC client code (apps target the IAM Profile spec)
+- deploying OpenBao itself (Railiance platform) — consumed, not built
+- tenant-specific federation policy for tenants beyond `tenant:platform`
+  and `tenant:coulomb`
+
+## Decide federation adoption and topology
+
+```task
+id: NK-WP-0011-T01
+state_hub_task_id: "a5807808-fb34-50de-8f67-9128011833d4"
+status: done
+priority: high
+```
+
+**Decision record — expanded-mode adoption & federation topology.** Write
+an ADR (ADR-0009) capturing: the concrete trigger for switching a tenant
+from lightweight to expanded mode; whether Keycloak acts as an OIDC
+identity broker, a SAML service provider, or both; the realm-per-tenant
+candidate and its alternatives mapped onto `tenant:platform` /
+`tenant:coulomb`; how the Keycloak issuer
+coexists with the KeyCape issuer (`kc.coulomb.social`) so applications
+still target one IAM Profile contract; and the canonical hostname/issuer
+for the broker. Resolve or supersede D2 from NK-WP-0001.
+
+## Admit the database consumer
+
+```task
+id: NK-WP-0011-T02
+state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487"
+status: wait
+priority: high
+blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence."
+needs_human: true
+decision_id: 8a5d1eb8-b665-4d25-9742-a15ecfc87c0c
+```
+
+**PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform
+and rapp-postgres admit a named Keycloak database consumer against the current
+database catalog and isolation needs. Do not assume the historical NK-WP-0003
+instance is the correct placement. Source credentials from OpenBao via ESO
+into a K8s Secret. Confirm the existing backup schedule covers the new database and
+run a restore drill for `keycloak_db` specifically.
+
+## Package the broker deployment
+
+```task
+id: NK-WP-0011-T03
+state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908"
+status: wait
+priority: high
+blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment."
+depends_on:
+  - NK-WP-0011-T02
+```
+
+**Deploy expanded-mode Keycloak.** Build a custom image
+(`kc.sh build`, privacyIDEA provider JAR included only if T5 delegates MFA
+to privacyIDEA). Assign the package/runtime owner under ADR-0015 and deploy
+through its managed declaration on railiance01 behind Traefik +
+cert-manager at the issuer hostname from T1. Admin bootstrap secret and DB
+secret come from OpenBao/ESO — never typed, never in git. Hostname
+strictness + proxy headers configured for Traefik. Realm import is
+GitOps-friendly (realm JSON/CR in git).
+
+## Integrate an upstream identity provider
+
+```task
+id: NK-WP-0011-T04
+state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
+status: wait
+priority: high
+blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence."
+depends_on:
+  - NK-WP-0011-T03
+```
+
+**Upstream federation.** Configure identity brokering for Entra ID (OIDC),
+on-prem AD (LDAP user federation), and a generic SAML 2.0 IdP. Map each
+source's claims/attributes into the NetKingdom IAM Profile shape: issuer,
+audience, subject, groups, **tenant**, and assurance evidence. Define the
+attribute/claim mappers and group→role mapping. Verify a federated login
+end-to-end for at least the Entra ID path.
+
+## Define federated assurance
+
+```task
+id: NK-WP-0011-T05
+state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
+status: wait
+priority: medium
+blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners."
+depends_on:
+  - NK-WP-0011-T04
+```
+
+**MFA / assurance source.** Decide and implement the assurance model: MFA
+enforced by privacyIDEA (via the Keycloak provider JAR + a "privacyIDEA
+Browser" flow, carried over from NK-WP-0001) versus trusting upstream IdP
+MFA (e.g. Entra Conditional Access) and reflecting it as assurance
+evidence in the token. Require step-up for admin console and
+platform-root-sensitive clients. Ensure assurance evidence is carried in
+the IAM Profile token so flex-auth can gate privileged actions on it.
+
+## Verify IAM conformance and coexistence
+
+```task
+id: NK-WP-0011-T06
+state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446"
+status: wait
+priority: high
+blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T04
+  - NK-WP-0011-T05
+```
+
+**IAM Profile conformance & downstream coexistence.** Run IAM Profile
+conformance checks against the Keycloak issuer (discovery document, PKCE,
+token/claim shape, JWKS, userinfo). Verify an application configured for
+the IAM Profile can authenticate against either the KeyCape or the
+Keycloak issuer per the T1 selection rule. Use the canonical
+`canon/standards/iam-profile_v0.3.md` contract and the executable suite in
+`tools/iam-profile-conformance/`. Document per-tenant issuer selection.
+
+## Enforce tenant and platform boundaries
+
+```task
+id: NK-WP-0011-T07
+state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833"
+status: wait
+priority: high
+blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T04
+  - NK-WP-0011-T05
+```
+
+**Recursive tenancy & authorization boundary.** Implement T1's reviewed
+realm/tenant topology with platform-root guardrails. If realm-per-tenant is
+selected, tenant admins manage only their realm; in every topology they
+must not be able to alter IAM Profile semantics, the platform realm,
+federation trust, OpenBao platform mounts, or audit retention (per the
+flex-auth/Topaz implications in the architecture doc). Confirm flex-auth +
+Topaz remains the PDP; if a Keycloak Authorization Services adapter is
+used at all, document it as a delegated, non-canonical adapter.
+
+## Prove recovery and audit delivery
+
+```task
+id: NK-WP-0011-T08
+state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
+status: wait
+priority: medium
+blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T02
+  - NK-WP-0011-T03
+```
+
+**Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative
+realm configuration belongs in git; keep credential-bearing exports in
+protected backup custody; DB backup + restore drill (T2); break-glass admin path disabled-by-default
+with alerting on use; Prometheus/Grafana for auth success/failure, MFA
+latency, federation errors. Ship Keycloak events to the durable platform
+audit sink alongside flex-auth/Topaz/OpenBao records, with correlation
+ids — satisfying the "Audit sink" and "Break-glass" rows of the
+production-readiness checklist.
+
+## Prove the isolation upgrade path
+
+```task
+id: NK-WP-0011-T09
+status: wait
+priority: medium
+state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e"
+blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T07
+  - NK-WP-0011-T08
+```
+
+**Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write
+the owner-executed upgrade runbook and rehearse it in an isolated environment
+before any paid tier is offered. The drill must show issuer URL unchanged,
+every user `sub` and federated link preserved, login working after cutover,
+rollback by re-routing during the retention window, and per-tier backup and
+restore evidence. Coordinate with tenant-engine on deriving the tier from the
+`IAM` capability role; do not add an independent tier field.
+
+## Acceptance Criteria
+
+- A rehearsed shared-to-dedicated isolation upgrade preserves issuer and subjects.
+- An ADR records the expanded-mode trigger, federation topology,
+  selected realm/tenant isolation model, and KeyCape/Keycloak issuer coexistence.
+- A federated user from at least one enterprise IdP (Entra ID) can log in
+  and receive an IAM Profile-conformant token with tenant + assurance
+  claims.
+- Keycloak secrets originate from OpenBao; none are bootstrapped from
+  KeePassXC or committed to git.
+- flex-auth + Topaz remains the authorization decision point; Keycloak is
+  not the canonical policy engine.
+- Tenant admins cannot cross the platform-root boundary.
+- Keycloak audit events land in the durable platform audit sink with
+  correlation ids, and a DR/break-glass drill has passed.
+
+## Open Questions / Dependencies on Other Repos
+
+- **key-cape**: does coexistence require KeyCape changes, or can both
+  issuers serve the same IAM Profile unchanged? (EP-NK-001 federation
+  extension point.)
+- **flex-auth**: confirmed claim/decision-envelope contract for tenant +
+  assurance evidence sourced from a federated token.
+- **railiance-platform**: OpenBao must expose a Keycloak auth role / ESO
+  path before T3; unseal/break-glass story must be ready.
+- **IAM Profile spec**: resolved by NK-WP-0012. T6 consumes
+  `canon/standards/iam-profile_v0.3.md` and
+  `tools/iam-profile-conformance/`.
+
+## Infrastructure review — 2026-09-28
+
+Keep in backlog until a named enterprise tenant, upstream IdP owner and
+concrete federation need justify operating another issuer. No Keycloak
+Deployment appears in today's cluster inventory. Realm-per-tenant remains a
+proposal to evaluate in T01, not a requirement derived from current topology;
+prove its mapping to tenant-engine's canonical identity/lifecycle contract.
+
+The live issuer is `https://kc.coulomb.social`; IAM v0.3 is accepted and v0.4
+step-up is proposed. T01/T05/T06 must coordinate with NK-WP-0042 and preserve
+existing issuer/subject account bindings, audiences and session/revocation
+behavior. Do not infer equivalent assurance from an upstream MFA claim without
+a reviewed trust mapping. The single-node cluster and single-instance database
+providers offer no automatic HA guarantee. T02/T08 must name backup ownership,
+off-host custody and an isolated restore proof. OpenBao access is private via
+the platform operator path. Resource placement, packaging and runtime
+execution belong to their owners, not this canon repository.
+
+Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
+
+## Dependency reconciliation — 2026-10-03
+
+Accepted ADR-0009 decision1 prohibits starting T02–T09 without the named
+tenant, upstream IdP owner and concrete unmet federation need. None is
+recorded in this plan. Corrected active/todo to blocked/wait; T01 remains done.
+Local preparation is complete in
+[expanded-mode admission requirements](../docs/architecture/expanded-mode-admission-requirements.md):
+owner deliverables, evidence gates, conformance limits and explicit resume criteria.
+New federation owner task IDs await trigger and owner acceptance; no deployment
+or issuer selection is implied by this packet.
+
+## Machine-readable wait reconciliation — 2026-10-03
+
+T02 is the adoption admission root: owner/sponsor Bernd Worsch must confirm
+all three accepted ADR-0009 triggers from real demand. The pending hub decision
+`8a5d1eb8-b665-4d25-9742-a15ecfc87c0c` records that demand is currently absent; it neither asks
+an agent to create demand nor grants a broker deployment. T02 also retains the
+subsequent database-owner admission and backup/restore requirements. Once the
+trigger exists, record actual owner task IDs before routing implementation.
+
+T03–T09 now encode their concrete predecessor deliverables in `depends_on`.
+Every path reaches T02; no terminal historical infrastructure plan substitutes
+for adoption. Existing per-task owner commitments/evidence remain in the
+blocking reasons and admission requirements document. A deferred/declined
+admission decision requires a deliberate retain/cancel review, not automatic
+resume. All eight tasks remain wait; the workplan remains blocked.
+
+Knowledge receipt: emergent-security 0.2.6 / start / verified-files /
+orientation-only; digest
+`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.
+
+> 2026-10-11: demoted to `flavor: residual` / `backlog` by founder-authorized triage — off the
+> critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
+> promote back when demand or risk appears. See the-custodian
+> `history/20261011-netkingdom-security-progress-assessment.md`.
diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
new file mode 100644
index 00000000..d0616047
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
@@ -0,0 +1,417 @@
+---
+id: NK-WP-0022
+type: workplan
+title: "Cut over NetKingdom identity to railiance01 and retire CoulombCore"
+domain: infotech
+repo: net-kingdom
+status: finished
+flavor: implementation
+owner: codex
+topic_slug: netkingdom
+created: "2026-07-27"
+updated: "2026-10-15"
+depends_on:
+  - USER-WP-0020
+  - NK-WP-0023
+  - KEY-WP-0004
+state_hub_workstream_id: "d76ddccc-00c8-548a-b141-2cd660fa38da"
+---
+
+# NK-WP-0022 - railiance01 identity cutover and CoulombCore retirement
+
+Move the authoritative lightweight NetKingdom identity stack from
+CoulombCore (`92.205.130.254`) to railiance01 (`92.205.62.239`) without
+losing users, groups, MFA enrollments, signing/encryption material, or the
+ability to roll back.
+
+At the July 27 migration baseline, the two servers ran independent copies of
+KeyCape, Authelia, LLDAP,
+privacyIDEA, and `net-kingdom-pg`. At that baseline, public KeyCape DNS pointed to
+railiance01 while other identity names still pointed to CoulombCore.
+T06/T07 below supersede that topology: identity cutover and reversible
+retirement completed on July 30 after the recorded migration gates passed.
+Final deletion completed on October 15 after the separate T08 recovery and
+approval gates were satisfied.
+
+The original cutover intentionally waited for the reusable user onboarding
+portal to complete the Binky tenant-admin flow. That supplied the human
+login/MFA and lifecycle evidence used to establish identity authority before
+state migration and reversible retirement.
+
+## T01 - Freeze the migration contract and inventory both stacks
+
+```task
+id: NK-WP-0022-T01
+status: done
+priority: high
+state_hub_task_id: "244ef874-8ee4-5969-bcbf-42a7cb47f246"
+```
+
+Capture secret-free inventories of deployments, image digests, configuration
+keys, database schemas/counts, PVCs, ingress, certificates, backup schedules,
+DNS, and external consumers on both clusters. Identify the authoritative
+source for every state set and record expected maintenance/write-freeze
+behavior. Compare public JWKS fingerprints and all client registrations
+without printing private configuration.
+
+Done when every component and state owner has a source, destination,
+verification method, rollback source, and explicit decision on whether
+railiance01 is already equivalent or requires migration.
+
+2026-07-28 DNS inventory: public resolvers show `auth.coulomb.social` and the
+new `login.coulomb.social` alias at railiance01 (`92.205.62.239`). The
+following names remain explicitly on CoulombCore (`92.205.130.254`):
+`bao`, `gitea`, `hub`, `lldap`, `pink-account`, and `pink` under
+`coulomb.social`. The last three are identity-cutover scope; Bao, Gitea, and
+Hub must be handed to their owning workload cutovers before CoulombCore host
+retirement. Local resolver caches may temporarily retain the former
+`auth.coulomb.social` address.
+
+The read-only comparison is recorded in
+`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. It confirms
+matching public KeyCape JWKS fingerprints and matching declared
+Authelia/LLDAP/privacyIDEA images, but independent PVCs and divergent LLDAP
+database fingerprints. CoulombCore exposes PostgreSQL logical backups but no
+matching LLDAP, Authelia, or privacyIDEA backup CronJobs; fresh protected
+source backups remain a hard gate.
+
+2026-07-29 closure review: the subsequent backup, migration, dependency and
+conformance tasks used this inventory successfully. Every identity state set
+now has an authority, protected rollback source and verification method; the
+remaining public names are tracked explicitly under T06 or their owning
+non-identity cutovers. Inventory contract complete.
+
+## T02 - Prove recoverable backups before changing state
+
+```task
+id: NK-WP-0022-T02
+status: done
+priority: high
+state_hub_task_id: "12658d0f-eee9-5553-92b6-956ccde094bf"
+```
+
+Create fresh, encrypted backups for CoulombCore LLDAP, Authelia,
+privacyIDEA, `net-kingdom-pg`, KeyCape configuration/signing key, and required
+Kubernetes Secrets. Preserve privacyIDEA encryption material with its
+database. Validate backup manifests, checksums, custody, retention, and a
+non-production restore drill. Never emit secret values into Git, State Hub,
+logs, or chat.
+
+Done when restore evidence proves the migration can be reversed from
+independent custody.
+
+2026-07-28: created the age-encrypted source set documented in
+`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. Checksums,
+age decryption, both SQLite integrity checks, PostgreSQL dump readability,
+privacyIDEA archive readability, permissions, and plaintext cleanup passed.
+The encrypted set was then copied to mode-`0700` independent custody on
+railiance01 with mode-`0600` files and matching source hashes. A temporary,
+non-networked PostgreSQL 16 pod restored the full dump and reproduced the
+expected `interhub`, `privacyidea_db`, token, owner, realm, resolver, and policy
+counts. The pod and transient restore log were removed automatically.
+
+## T03 - Reconcile persistent identity state onto railiance01
+
+```task
+id: NK-WP-0022-T03
+status: done
+priority: high
+state_hub_task_id: "642cec3f-fd96-5c05-a37a-8696ed118811"
+```
+
+Under a bounded write freeze, compare and migrate the authoritative
+`net-kingdom-pg` data and any non-database LLDAP, Authelia, or privacyIDEA
+state. Preserve user/group identifiers, password hashes, MFA token serials,
+realms, resolver mappings, encryption keys, and audit-relevant timestamps.
+Do not blindly overwrite newer railiance01-only configuration such as the
+`rapp-qonto-client`; merge and verify it explicitly.
+
+Done when source/destination counts and semantic probes agree and restart
+tests pass on railiance01.
+
+Pre-migration comparison proves this task is required: LLDAP is 4/7/7
+users/groups/memberships on CoulombCore versus 3/7/3 on railiance01.
+CoulombCore privacyIDEA has one enrolled token, two realms, two resolvers, and
+two policies; railiance01 is empty. All privacyIDEA custody fingerprints
+differ, so its database and encryption/signing material must migrate together.
+
+2026-07-28: completed the bounded reconciliation documented in
+`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. Fresh encrypted
+source and destination snapshots preceded all changes. LLDAP now contains the
+authoritative `platform-root` identity and memberships plus preserved
+railiance01-only users and tenant groups; disposable source lifecycle users
+were excluded. privacyIDEA database counts and all matching custody
+fingerprints agree. Twelve nonempty interhub source-table digests agree while
+the newer destination schema, migration ledger, and destination-only user were
+preserved. SQLite integrity, privacyIDEA HTTP, deployment rollout, and
+post-restart semantic probes passed. Transient artifacts were removed and
+CoulombCore writers remain frozen against divergence.
+
+## T04 - Align configuration, secrets, and internal dependencies
+
+```task
+id: NK-WP-0022-T04
+status: done
+priority: high
+state_hub_task_id: "8aab3b5d-ec9e-5bc0-a884-ee418e78d5f4"
+```
+
+Reconcile KeyCape, Authelia, LLDAP, and privacyIDEA configuration and secret
+references on railiance01 through approved custody lanes. Verify KeyCape uses
+only railiance01 cluster-local dependencies, signing-key continuity is
+preserved, service clients remain registered, and no runtime dependency
+points back to CoulombCore.
+
+Done when an automated dependency graph and negative search prove there are
+no hidden CoulombCore runtime dependencies.
+
+2026-07-28: added
+`sso-mfa/k8s/verify-identity-cutover-dependencies.sh`. Its live railiance01
+run found no CoulombCore IP/host or public cross-cluster endpoint in decoded
+identity Secrets, ConfigMaps, Deployments, or StatefulSets. It verified
+cluster-local KeyCape and privacyIDEA dependencies, retained user-engine and
+rapp-qonto clients, and Ready deployments. KeyCape signing fingerprints
+match. TLS-preserving direct resolution returned HTTP 200 with valid
+certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`.
+
+## T05 - Run full pre-cutover identity conformance
+
+```task
+id: NK-WP-0022-T05
+status: done
+priority: high
+state_hub_task_id: "a66acc29-33a7-5c20-8816-c3acedd6595d"
+```
+
+Using TLS-preserving direct resolution to railiance01, verify health,
+discovery/JWKS, authorization-code + PKCE login, MFA, tenant/group/role
+claims, OpenBao OIDC login, `rapp-qonto` client credentials, wrong-secret and
+wrong-scope denial, logout/session behavior, and restart recovery. Include
+the platform-root and Binky tenant paths without exposing tokens.
+
+Done when all critical human and service flows pass and rollback criteria are
+machine-readable.
+
+2026-07-28 progress: the portal starts a KeyCape authorization-code flow with
+S256 PKCE, and KeyCape discovery/TLS is healthy at its canonical
+`kc.coulomb.social` issuer. `rapp-qonto-client` obtains a token only for
+`qonto:read`; a wrong secret returns 401 and excessive `qonto:write` returns
+400 without a token. The Binky administrator was created and provisioned
+through user-engine's deployed versioned API, producing a linked LLDAP
+identity and `password_setup_required` state. This exposed and fixed newline
+normalization for the portal's trusted proxy secret in user-engine
+`0ef2ae5`; 105 tests pass and the fixed image is live.
+
+The missing SMTP dependency is now removed from the critical path by the
+deployed NetKingdom-owned password setup surface. It issues 15-minute,
+single-use opaque links, revokes an older link on renewal, consumes before
+calling LLDAP's official OPAQUE helper, and fails closed on restart. A
+disposable-user conformance run proved renewal, validation, setup, LLDAP
+login, replay denial, and cleanup without emitting credentials. Human
+acceptance remains open only for Binky's user-chosen password, MFA enrollment,
+and final claim/denial checks; no operator-set password was substituted.
+
+2026-07-29 complete: platform-root completed password + OTP login and opened
+the portal and OpenBao paths. Binky then completed reusable password setup,
+TOTP enrollment, and a fresh authorization-code login after the KeyCape
+rollout. The session verified the canonical issuer/audience, Binky tenant and
+groups, tenant-admin role, AAL2 `pwd` + `otp`, and denial for platform and
+Coulomb administration. Together with the prior qonto positive/negative
+client tests and TLS/discovery evidence, pre-cutover conformance passes.
+
+## T06 - Cut over remaining DNS with monitored rollback
+
+```task
+id: NK-WP-0022-T06
+status: done
+priority: high
+state_hub_task_id: "fc9ed5fb-fd5c-5b04-990b-5a5b7f32fa0f"
+```
+
+Lower TTL where needed and move `auth.coulomb.social`,
+`lldap.coulomb.social`, `pink.coulomb.social`, and
+`pink-account.coulomb.social` to `92.205.62.239`. Confirm certificate,
+ingress, resolver, and normal-DNS flows from multiple resolvers. Keep
+CoulombCore intact but prevent divergent writes during a defined observation
+window. Roll back DNS if critical authentication or MFA gates fail.
+
+Done when normal DNS consistently resolves to railiance01 and the observation
+window passes without fallback traffic or state divergence.
+
+2026-07-28: authoritative/public recursive DNS now returns railiance01 for
+`auth.coulomb.social`; `login.coulomb.social` was added as an Authelia ingress
+and trusted certificate alias. The complete portal → KeyCape → Authelia
+redirect reaches railiance01. LLDAP and both privacyIDEA names remain
+intentionally on CoulombCore pending the state and conformance gates above.
+
+2026-07-30 recheck: normal resolution now sends `auth`, `login`, `pink`,
+`pink-account`, and `kc` to railiance01 (`92.205.62.239`). Only
+`lldap.coulomb.social` still resolves to CoulombCore (`92.205.130.254`);
+`bao` remains there intentionally and is outside this identity-workload
+cutover. No automated DNS credential lane is registered: `warden route find`
+returned generic OpenBao/login/SSH routes, not provider DNS authority.
+Consequently T06 remains in progress on one explicit operator DNS change and
+its observation window, rather than being closed cosmetically.
+
+2026-07-30 completion: the operator moved `lldap.coulomb.social` to
+railiance01. Normal resolution now sends `auth`, `login`, `lldap`, `pink`,
+`pink-account`, and `kc` to `92.205.62.239`; only the explicitly retained
+`bao`, retired `gitea`, and `hub` names resolve to CoulombCore. HTTPS probes
+for Authelia, LLDAP, both privacyIDEA surfaces, and KeyCape discovery pass on
+the public path. Direct TLS-preserving requests to the old IP return 404 for
+each identity hostname, proving the stale ingress has no functioning backend.
+The observation gate therefore passes without fallback traffic.
+
+## T07 - Retire CoulombCore identity workloads reversibly
+
+```task
+id: NK-WP-0022-T07
+status: done
+priority: high
+state_hub_task_id: "2a6d4c0b-2565-5bf5-9c04-1b63e992ce99"
+```
+
+After T01-T06, scale the old KeyCape, Authelia, LLDAP, and privacyIDEA
+deployments to zero and suspend old backup jobs/ingress. Preserve manifests,
+PVCs, database, Secrets, and encrypted final backup during a rollback
+retention period. Confirm no DNS, ingress, client, monitor, or traffic still
+targets the old services.
+
+Deletion of old workloads, PVCs, database clusters, or secret material is a
+separate destructive action permitted only after the retention period and an
+explicit recorded approval.
+
+Done when CoulombCore serves no identity traffic and remains recoverable
+during the retention window.
+
+2026-07-30 inventory: legacy KeyCape, LLDAP, and privacyIDEA are already scaled
+to zero with their resources retained; only CoulombCore Authelia remains at
+one replica. It must not be scaled down until the final LLDAP DNS record and
+T06 observation gate pass. The reversible retirement is therefore reduced to
+one remaining workload plus stale ingress/backup checks.
+
+2026-07-30 completion: after T06 passed, CoulombCore Authelia was scaled to
+zero. KeyCape, LLDAP, privacyIDEA, and Authelia are now all zero replicas.
+No legacy identity backup CronJobs remain present. Services, Ingresses,
+ConfigMaps, Secrets, PVCs, TLS material, and source manifests were deliberately
+retained. Public identity probes still reach healthy railiance01 endpoints,
+while direct old-IP identity requests return 404. The reversible rollback
+window begins 2026-07-30; no retained state may be deleted under this task.
+
+## T08 - Final deletion and closure
+
+```task
+id: NK-WP-0022-T08
+status: done
+needs_human: false
+decision_id: 5d8dcdb5-6d7b-463e-bb39-0a4737331403
+priority: medium
+state_hub_task_id: "42a3b4c0-3481-5cfa-bdc2-66d05e751829"
+```
+
+2026-10-11: founder confirmed coulombcore is needed for nothing; retire and reuse the machine. Evidence of the frozen old ArgoCD: railiance-platform docs/evidence/2026-10-11-coulombcore-argocd-frozen.md. The inter-hub-coulombcore bridge tunnel can be retired with the machine.
+
+2026-10-11: requalified — drill owner is Sol (blue lane). See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md (Round 3).
+
+2026-10-11: requalified — D4 batch approval, conditional on drill receipt and retention expiry. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
+After explicit approval, expiry of the rollback retention window, and one
+successful railiance01 restore/restart drill, remove the retired CoulombCore
+identity resources and stale DNS/monitoring/configuration. Record what was
+deleted, backup retention, recovery limits, final topology, and operational
+runbooks. Run `statehub fix-consistency`.
+
+Done when railiance01 is the sole authoritative identity stack, all evidence
+is reconciled, and the workplan is marked finished.
+
+Retention minimum: 2026-08-29 has passed. The plan is no longer date-blocked.
+The October11 D4 batch and Round4 decision below supply the destructive
+approval; no repeated approval is required within that scope once its recovery
+condition is met. Elapsed retention alone does not satisfy the required passing
+railiance01 restore/restart receipt.
+
+2026-10-03: human gate routed to hub decision 5d8dcdb5-6d7b-463e-bb39-0a4737331403 (D4: Destructive cleanup after retention expiry: CoulombCore remnants, railiance-master retention, live recipient removal) by CUST-WP-0075; resolving that decision raises C-40 here.
+
+## Safety gates
+
+- No retirement before a tested backup and restore path exists.
+- No database overwrite before authoritative-source and divergence analysis.
+- No privacyIDEA restore without its matching encryption material.
+- No normal-DNS cutover before direct-resolution end-to-end verification.
+- No PVC/database/Secret deletion as part of the reversible retirement step.
+- Final deletion always requires an explicit human approval distinct from DNS
+  cutover approval.
+
+## Infrastructure review — 2026-09-28
+
+Live read-only inventory confirms the identity services on railiance01 are
+ready. CoulombCore was not inspected in this review; do not infer that its
+retained resources have been deleted. Recheck the exact retained identity
+resources and backup custody before preparing the T08 deletion list. A generic
+platform-pg recovery drill is not a restore of LLDAP, Authelia, privacyIDEA
+with its encryption material, and identity database state. At that review, whole-host retirement
+and other owners' workloads remained outside the identity-only deletion gate;
+the October 11 founder decision subsequently authorized host retirement.
+
+Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
+
+## Final retirement completion — 2026-10-15
+
+Completed all eight tasks. The October 11 D4 batch approval and Round 4 founder
+instruction authorize retirement of the otherwise unneeded CoulombCore host.
+Retention expired August 29. The October 14 owner restart receipt reports
+`reboot_comparison.passed=true`, exactly one reboot, unchanged database
+identities and no new failing pods. Its SHA256 is
+`6e41778472b4f6093614ecd51a2a0d7e7e19608a0885162764f1c605dbde7b2b`;
+source: `railiance-platform/docs/evidence/2026-10-14-rpf-wp-0015-t03-reboot/post-reboot-preflight.json`.
+This satisfies D4's passing restore/restart condition. The separate deferred
+audit E2 in RPF-WP-0015-T03 is not a named D4 condition and remains open with
+its owner. The initial review held this task while checking that distinction;
+source review resolved it without inventing a new approval or identity restore.
+The July isolated identity backup restore remains the identity recovery proof.
+
+Read-only SSH inventory identified the exact old host `92.205.130.254`, its
+hostname and boot ID, 35 running containers and 18 retained PVC directories.
+Verified the installed root-owned k3s uninstall/killall script digests before
+execution. At 20:06–20:07 UTC, stopped and disabled k3s and ran the reviewed
+installed uninstall script. All commands succeeded. This removed the retired
+cluster, containers, local PVCs, databases, Secrets and cluster credential state.
+No expired Kubernetes API access, certificate rotation or k3s restart was used.
+
+Independent postchecks confirm no k3s/containerd processes, no retired cluster
+mounts, and absence of `/var/lib/rancher/k3s`, `/var/lib/kubelet`,
+`/etc/rancher/k3s`, `/run/k3s`, the k3s binary and systemd unit. The host remains
+SSH reachable. The obsolete `inter-hub-coulombcore` tunnel was stopped and
+removed from the workstation bridge configuration; all five railiance01 tunnel
+declarations remain present and connected.
+
+All six public identity names (`auth`, `login`, `lldap`, `pink`, `pink-account`,
+`kc`) still resolve to `92.205.62.239`; HTTPS checks, including KeyCape OIDC
+discovery, pass after retirement. Bao and Hub also resolve to railiance01.
+Railiance01 is the sole authoritative identity stack. The independent encrypted
+July identity backup set remains in railiance01 custody with mode0600 files;
+no independent backup was deleted. Recovery now uses that protected backup
+and the current owner recovery runbooks, rather than retained old cluster PVCs.
+The metadata check does not claim a fresh full identity restore.
+
+Boundaries: this removed cluster state, not the provider OS or every host file;
+it is not a secure full-disk erase. Machine reinstallation/reuse belongs to the
+fleet phoenix work (`railiance-cluster/workplans/RCLUSTER-WP-0007-threephoenix-ha-cluster.md`).
+The non-identity, retired `gitea.coulomb.social` DNS record still points to the
+old address; its provider DNS cleanup remains with the forge/fleet owner,
+outside the completed identity DNS cutover. No provider DNS credential lane
+was identified, and no DNS deletion is claimed. Do not restore old k3s or
+rotate its expired certificates to repurpose the machine.
+
+Evidence: [retirement preflight](../docs/evidence/2026-10-15-coulombcore-retirement/retirement-preflight.json),
+[host inventory](../docs/evidence/2026-10-15-coulombcore-retirement/host-inventory.json),
+[execution receipt](../docs/evidence/2026-10-15-coulombcore-retirement/host-cluster-retirement-result.json),
+[independent host postcheck](../docs/evidence/2026-10-15-coulombcore-retirement/post-retirement-host-verification.json),
+[public identity postcheck](../docs/evidence/2026-10-15-coulombcore-retirement/post-retirement-public-identity-checks.json),
+[tunnel retirement](../docs/evidence/2026-10-15-coulombcore-retirement/tunnel-retirement.json),
+and [backup metadata](../docs/evidence/2026-10-15-coulombcore-retirement/independent-backup-metadata.json).
+
+Knowledge orientation reloaded: Emergent Security 0.2.6,
+digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
+withheld/orientation-only; actual owner decisions, recovery source and runtime
+metadata were reviewed. Orientation does not confer execution authority.