diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md
index 9857f82..6c9d804 100644
--- a/.ciagent/REQUIREMENTS.md
+++ b/.ciagent/REQUIREMENTS.md
@@ -121,7 +121,7 @@
 | REQ-20 | 07 | complete (v1.1.2) |
 | REQ-21 | 07 | complete (v1.1.2) |
 | REQ-22 | 07 | complete (v1.1.2) |
-| REQ-23 | 08 | pending |
+| REQ-23 | 08 | complete (v1.1.3) |
 | REQ-24 | 09 | pending |
 | REQ-25 | 10 | pending |
 | REQ-26 | 09 | pending |
diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md
index 9817edb..c19b596 100644
--- a/.ciagent/ROADMAP.md
+++ b/.ciagent/ROADMAP.md
@@ -100,7 +100,7 @@ milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
 
 ### Phase 08 — aws-oidc-bootstrap
 - **Description:** **Re-scoped per RESEARCH TARGET 1 + D-039.** Gitea Actions does not support `id-token: write` (conf 0.95), so real OIDC is deferred to v1.2. This phase instead: uses the temporary long-lived key (waiver D-034) once to create an S3 state bucket, a DynamoDB lock/outbox table, and an IAM user with a minimal scoped policy (S3 + DynamoDB + plan-only); stores the key as a Gitea Actions secret; implements `scripts/rotate_spike_key.sh` to rotate the key after each spike run. Real OIDC federation is tracked via go-gitea/gitea#36988 for v1.2.
-- **Status:** pending
+- **Status:** complete (v1.1.3)
 - **Depends on:** [07]
 - **Requirements:** REQ-23 (re-interpreted: AWS auth bootstrap + state backend; OIDC deferred to v1.2 per D-039)
 - **Success Criteria:**