diff --git a/.custodian-brief.md b/.custodian-brief.md
index e32c9b0..407cfed 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,20 +2,19 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-07-29 22:37 UTC  
+**Last synced:** 2026-07-29 22:39 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Production self-service and user administration portal
-Progress: 3/8 done  |  workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519`
+Progress: 4/8 done  |  workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519`
 
 **Open tasks:**
 - ! T06 - Security, accessibility, and workflow conformance  `39dc383c`
 - ! T08 - Closure and next-stage handoff  `ecbdeef3`
 - ► T03 - Implement self-service login and registration UX  `45ed1485`
 - ► T04 - Implement tenant-admin and platform-admin UX  `16555b68`
-- ► T05 - Add production persistence and operability  `65ff5c96`
 
 ## Inbox Hygiene
 
diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
index 951bbb6..055d354 100644
--- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
+++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-28"
+updated: "2026-07-30"
 depends_on:
   - USER-WP-0014
   - USER-WP-0015
@@ -54,7 +54,7 @@ metadata for that later stage.
 
 ```task
 id: USER-WP-0020-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
 ```
@@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain.
 
 ```task
 id: USER-WP-0020-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
 ```
@@ -162,10 +162,14 @@ and rollback/roll-forward no longer depends on containerd retaining local
 tags. An age-encrypted user-engine Postgres dump was uploaded through the
 established activity-core offsite lane with plaintext cleanup.
 
-The remaining T05 item is migration of the portal edge marker and provisioner
-service token from bootstrap Kubernetes Secrets into an OpenBao-owned,
-ExternalSecret-delivered, rotatable lane. This requires the ops-mason
-executive approval gate for new secret custody.
+2026-07-30 completion: the approved ops-mason plan moved the portal edge
+marker and provisioner service token into one exact OpenBao workload path,
+delivered through separate bounded AppRoles and namespace-restricted
+ExternalSecret stores. A coordinated rotation converged all three derived
+Secrets before restarting the portal and provisioner, and both Deployments
+returned Ready. Exact-path access succeeds, sibling-path access is denied,
+the derived client/server tokens match, and a post-rotation disposable
+identity reconciliation passed. No secret value entered recorded evidence.
 
 ## T06 - Security, accessibility, and workflow conformance