diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md
index 2b14bcf..4663353 100644
--- a/DECISIONS-LOG.md
+++ b/DECISIONS-LOG.md
@@ -28,11 +28,13 @@ need the operator are called out.
 - **Flux INSTALLED** on the cluster (4 controllers Running). Host **Gitea working** (named-volume fix),
   repo pushed. GitRepository created → **BLOCKED**: cluster pods can't reach `10.73.0.1:3000`
   (firewalld `libvirt` zone drops VM→host:3000).
-  - **Now codified as IaC (per operator: no manual commands):** `infra/ansible/playbooks/host-prereqs.yml`
-    opens the port idempotently; `bootstrap/gitea/bootstrap-gitea.sh` now **fully automates** admin +
-    public repo + push (was manual). A rebuild is hands-off. To APPLY the firewall (I lack
-    non-interactive sudo): `ansible-playbook infra/ansible/playbooks/host-prereqs.yml --ask-become-pass`
-    (or passwordless host sudo for unattended rebuilds). Then Flux reconciles → Phase-1 T-1.4 exit.
+  - **RESOLVED (operator added the ansible-vault become password):** ran `host-prereqs.yml` (firewall
+    opened via vault→become), VM→Gitea = 200, and **Flux GitRepository is READY=True**
+    (`main@sha1:a2f3bdc…`). **Phase-1 T-1.4 core is DONE** — Flux installed + reconciling clusters/dev
+    from the host Gitea. `platform`/`apps` Kustomizations intentionally NOT created (Option A) — the
+    running cluster is untouched.
+  - Firewall + Gitea admin/repo/push + host become password are all IaC now (host-prereqs.yml,
+    bootstrap-gitea.sh automation, vaulted group_vars/hypervisor) → destroy/rebuild is hands-off.
 - **NOT deployed:** `platform`/`apps` Kustomizations were deliberately NOT created — the running
   cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.
 
diff --git a/infra/ansible/inventory/group_vars/hypervisor/vault.yml b/infra/ansible/inventory/group_vars/hypervisor/vault.yml
new file mode 100644
index 0000000..a858c73
--- /dev/null
+++ b/infra/ansible/inventory/group_vars/hypervisor/vault.yml
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+39346534623335313934643366643533306236663431656530363566393162623564623339346230
+3032623531306264356263396638633935616534633130350a646465663861393862356261383938
+37396335333338313435313831623238663937646436366332323266323561336664396536336335
+6339386664656139380a373663316565376633313234653037633066393361613565343064393766
+30623430616235373534396665333834633662313362633837656562663061653730383464333339
+3563633139633731393330363333373161623739623762343266