chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-07-30:
  - USER-WP-0020-T02: progress → done

workplans/USER-WP-0020-self-service-and-user-administration-portal.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-28"
+updated: "2026-07-30"
 depends_on:
   - USER-WP-0014
   - USER-WP-0015
@@ -54,7 +54,7 @@ metadata for that later stage.
 
 ```task
 id: USER-WP-0020-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
 ```
@@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain.
 
 ```task
 id: USER-WP-0020-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
 ```
@@ -162,10 +162,14 @@ and rollback/roll-forward no longer depends on containerd retaining local
 tags. An age-encrypted user-engine Postgres dump was uploaded through the
 established activity-core offsite lane with plaintext cleanup.
 
-The remaining T05 item is migration of the portal edge marker and provisioner
-service token from bootstrap Kubernetes Secrets into an OpenBao-owned,
-ExternalSecret-delivered, rotatable lane. This requires the ops-mason
-executive approval gate for new secret custody.
+2026-07-30 completion: the approved ops-mason plan moved the portal edge
+marker and provisioner service token into one exact OpenBao workload path,
+delivered through separate bounded AppRoles and namespace-restricted
+ExternalSecret stores. A coordinated rotation converged all three derived
+Secrets before restarting the portal and provisioner, and both Deployments
+returned Ready. Exact-path access succeeds, sibling-path access is denied,
+the derived client/server tokens match, and a post-rotation disposable
+identity reconciliation passed. No secret value entered recorded evidence.
 
 ## T06 - Security, accessibility, and workflow conformance