memory: ratatoskr resolved (operator chose admin; worldtree-dev self-served key 90db1fbd)

persistent-memory.md

@@ -142,11 +142,13 @@ _As of 2026-06-20:_
   recreate — avoided the stale-`:latest` footgun). worldtree-dev self-served the
   CI re-run via the claude-bot Actions token → **run 1290 GREEN, demo on
   v0.37.7**, capability routing live. claude-bot token migration DONE for
-  worldtree-dev (off vh's personal PAT). **QUEUED (NON-URGENT):** the ratatoskr
-  readonly-admin tier lives in `config/policies.yaml` (006d233, in 439bebf) —
-  re-stage that file to personal's bind-mount + reload personal Heimdall, then
-  mint a `ratatoskr-readonly` key (tier=readonly-admin, distinct from their
-  send-only c990f0be) + deliver.
+  worldtree-dev (off vh's personal PAT). **RATATOSKR RESOLVED (2026-06-20):**
+  operator chose admin-now over readonly → worldtree-dev self-served the mint
+  (`ratatoskr-admin` key_id 90db1fbd on personal, distinct from their send-only
+  c990f0be) via their new admin key. The readonly-admin tier stays canonical +
+  is API-mintable (d2e9f05); laying its `config/policies.yaml` to personal is now
+  OPTIONAL/non-urgent (no consumer waiting) — do it only if least-privilege is
+  later wanted.
 
 - **🟠 BACKUP DIAGNOSIS (2026-06-20, full probe) — REVISED from "all ana
   backups down": PBS + nh3-restic are HEALTHY & CURRENT; only the ANA-side