Add infrastructure stabilization checkpoint

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -8,7 +8,7 @@ status: active
 owner: custodian
 topic_slug: custodian
 created: "2026-03-20"
-updated: "2026-06-22"
+updated: "2026-06-27"
 state_hub_workstream_id: "293a74fe-a85a-4ad6-8933-23d52a72fe8b"
 ---
 
@@ -57,7 +57,7 @@ OAS gives the viable infrastructure.
 
 ```task
 id: CUST-WP-0025-T01
-status: todo
+status: cancel
 priority: high
 state_hub_task_id: "f55078b6-7fa3-49ab-be30-37db622d64c9"
 ```
@@ -68,11 +68,13 @@ foundation for all hubs and services.
 
 Cross-reference: net-kingdom NK-WP-0001.
 
+2026-06-27 sequencing update: cancelled as an obsolete prerequisite. `NK-WP-0001` is archived and superseded by the KeyCape/Authelia/LLDAP lightweight stack, `NK-WP-0012` IAM Profile v0.2, and the proposed `NK-WP-0011` expanded-mode Keycloak federation lane. FOS bootstrap should not wait for this old Keycloak path.
+
 ### T02 — Complete NK-WP-0002: Local identity bootstrap
 
 ```task
 id: CUST-WP-0025-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "0d7792f7-5695-4e1a-9726-b9661d5e7108"
 ```
@@ -83,6 +85,8 @@ development of hub services without cluster dependency.
 
 Cross-reference: net-kingdom NK-WP-0002.
 
+2026-06-27 sequencing update: marked done. `NK-WP-0002` is complete: local-identity file store, Keycloak export, minimal localhost OIDC provider, permissions hardening, audit log, and docs are all delivered.
+
 ### T03 — IAM Profile integration test
 
 ```task
@@ -100,6 +104,8 @@ Write a minimal test service + integration test that:
 
 This test becomes the template for hub-core auth middleware.
 
+2026-06-27 sequencing update: this remains the real open identity gate, but it should target the current NetKingdom IAM Profile v0.2 contract and either local-identity or KeyCape lightweight issuer, not the archived `NK-WP-0001` Keycloak path.
+
 ### T04 — Canon standard: IAM Profile specification
 
 ```task