diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json
index 41952e3..2e0a183 100644
--- a/docs/work/_system/_state.json
+++ b/docs/work/_system/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-07-12T20:24:38.709Z",
+  "updated_at": "2026-07-12T20:37:41.771Z",
   "epics": {
     "platform-retrofit": {
       "status": "done",
@@ -131,10 +131,10 @@
           ]
         },
         "03-workspaces-feature-core": {
-          "status": "todo",
+          "status": "done",
           "title": "workspaces feature core — connect, status, list + encrypted credential storage",
           "ac_total": 4,
-          "ac_completed": 0,
+          "ac_completed": 4,
           "depends_on": [],
           "blocks": []
         },
@@ -236,11 +236,6 @@
     }
   },
   "ready": [
-    {
-      "epic": "walking-skeleton",
-      "story": "03-workspaces-feature-core",
-      "title": "workspaces feature core — connect, status, list + encrypted credential storage"
-    },
     {
       "epic": "walking-skeleton",
       "story": "04-runner-app-protocol-clone-install",
@@ -271,7 +266,6 @@
       "story": "06-runner-provisioner-port",
       "title": "IRunnerProvisioner port + local-process and single-host Docker implementations",
       "waiting_on": [
-        "walking-skeleton/03-workspaces-feature-core",
         "walking-skeleton/04-runner-app-protocol-clone-install"
       ]
     },
diff --git a/docs/work/epics/walking-skeleton/03-workspaces-feature-core/_story.md b/docs/work/epics/walking-skeleton/03-workspaces-feature-core/_story.md
index a2e004e..8824653 100644
--- a/docs/work/epics/walking-skeleton/03-workspaces-feature-core/_story.md
+++ b/docs/work/epics/walking-skeleton/03-workspaces-feature-core/_story.md
@@ -3,7 +3,7 @@ id: 03-workspaces-feature-core
 epic: walking-skeleton
 title: workspaces feature core — connect, status, list + encrypted credential storage
 type: user-story
-status: todo
+status: done
 feature: workspaces
 depends-on: []
 blocks:
@@ -13,6 +13,7 @@ blocks:
     10-web-next-wiring,
   ]
 created: 2026-07-12T10:24:14Z
+updated: 2026-07-12T20:37:41.484Z
 ---
 
 ## Goal
@@ -50,7 +51,9 @@ The workspace is the root entity of the entire skeleton: provisioning (story 06)
 
 ## Tasks
 
-- [ ] Run `pnpm turbo gen feature workspaces` → green feature scaffold (manifest, contracts, binders, controllers, tests, dev-seed).
-- [ ] Add `connectWorkspace` use case — manifest entry (`mutates: true`, `audits: ["workspace-connected"]`), input schema (name + git URL + PAT), output schema (credential never included), red test → green impl, DI wiring with audit emission, tRPC procedure.
-- [ ] Add the Workspaces Payload collection + real repository: PAT encrypted AES-256-GCM with a scrypt-derived key from `VEECT_SECRET`, write-only field (Payload API never returns it); repository contract suite covering mock + Payload impls incl. the write-only credential behavior.
-- [ ] Add `getWorkspaceStatus` and `listWorkspaces` use cases — manifest entries, contracts, red tests → green impls, DI wiring, tRPC procedures — returning persisted workspace/runner status.
+- [x] Run `pnpm turbo gen feature workspaces` → green feature scaffold (manifest, contracts, binders, controllers, tests, dev-seed).
+- [x] Add `connectWorkspace` use case — manifest entry (`mutates: true`, `audits: ["workspace-connected"]`), input schema (name + git URL + PAT), output schema (credential never included), red test → green impl, DI wiring with audit emission, tRPC procedure.
+- [x] Add the Workspaces Payload collection + real repository: PAT encrypted AES-256-GCM with a scrypt-derived key from `VEECT_SECRET`, write-only field (Payload API never returns it); repository contract suite covering mock + Payload impls incl. the write-only credential behavior.
+- [x] Add `getWorkspaceStatus` and `listWorkspaces` use cases — manifest entries, contracts, red tests → green impls, DI wiring, tRPC procedures — returning persisted workspace/runner status.
+
+_Landed: 6216897 + 8219c1f + c990e1b + eec402d (cherry-picks of the four slices), adversarial-reviewer-approved: single decrypt path verified through every export chain, leaky-repo strip test genuine, tamper/wrong-secret/salt-uniqueness covered. Non-blocking follow-ups: (1) isEncryptedCredential v1:-prefix idempotency guard could theoretically store a colon-crafted PAT as plaintext (read-denied on all paths, no leak — future hardening); (2) implementer's claimed @trpc/server repo-wide pin was NOT actually in the diff (alignment achieved via ^11.0.0 resolution; no regression)._