---
id: w7/m7/t006
title: Closeout — DoD verified, milestone moved to done/
worker: worker7
status: todo
estimate: 15m
depends_on: [w7/m7/t005]
---

## Objective

Close the milestone once the DoD holds. Verify neither the operator nor bex-api can read Secrets cluster-wide, the CI guard is live, and both services still function; then perform the `/pm done` move.

## Context

- DoD (milestone README): operator + bex-api hold no cluster-wide unrestricted secrets read; scoped to actual use; CI guard fails on regression; both services still function.
- Closing move mechanics: `.claude/commands/pm.md` § `done` (step 4 moves the whole milestone to `w7/done/m7/` and checks the box in the w7 README).

## Steps

1. Verify the DoD: inspect the effective RBAC (scoped, no cluster-wide secrets read), confirm the CI guard runs and would catch a regression, and confirm operator + bex-api still work (dev-loop/envtest evidence).
2. Set every remaining task `status: done`, mark rows `— **DONE**`, set `**Status:** done`.
3. Run `/pm done w7/m7/t006` to move the milestone to `w7/done/m7/` and check `- [x]` in the w7 README.

## Files

- `.pm/w7/m7/**` (statuses), `.pm/w7/README.md` (checkbox)

## Acceptance criteria

- [ ] DoD verified (scoped RBAC + live guard + services functional), with a note on what was exercised.
- [ ] Milestone moved to `w7/done/m7/`; w7 README box checked; no tombstone at `w7/m7`.

## Out of scope

- Any remaining implementation (must be done first).
