diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json
index d3180a8..42f40e4 100644
--- a/.ciagent/CHECKPOINT.json
+++ b/.ciagent/CHECKPOINT.json
@@ -1,17 +1,17 @@
 {
-  "phase": 3,
+  "phase": 5,
   "stage": "complete",
   "milestone": "v0.12",
   "milestone_slug": "security-hardening",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-07T10:57:00Z",
+  "updated_at": "2026-08-07T11:03:00Z",
   "milestone_complete": false,
   "previous_milestone": "v0.11",
-  "wave": "B (P04-P08 zero-trust identity) next",
-  "phases_shiped": ["P0", "P1", "P2", "P3"],
-  "tags_shipped": ["v0.11.0", "v0.11.1", "v0.11.2", "v0.11.3"],
-  "binding_conditions": ["C-29", "C-30", "C-31", "C-32", "C-33", "C-34", "C-35", "C-36", "C-37", "C-38"],
+  "wave": "B (P06 ACL rewrite, P07 password removal, P08 master key seal) next",
+  "phases_shiped": ["P0","P1","P2","P3","P4","P5"],
+  "tags_shipped": ["v0.11.0","v0.11.1","v0.11.2","v0.11.3","v0.11.4","v0.11.5"],
+  "binding_conditions": ["C-29","C-30","C-31","C-32","C-33","C-34","C-35","C-36","C-37","C-38"],
   "phase_count": 29,
   "load_bearing_rule": "R-021"
 }