diff --git a/notes/bf-22vc5-attempt-2026-06-04-3.md b/notes/bf-22vc5-attempt-2026-06-04-3.md
new file mode 100644
index 0000000..91f9760
--- /dev/null
+++ b/notes/bf-22vc5-attempt-2026-06-04-3.md
@@ -0,0 +1,150 @@
+# BF-22VC5 Blocked - Attempt 2026-06-04 14:30 UTC
+
+## Task
+Deploy P0: build acb-enrichment Docker image and re-enable deployment (apexalgo-iad)
+
+## Current Status
+**BLOCKED** - Cannot proceed without iad-ci cluster access OR Docker Hub credentials
+
+## Infrastructure Requirements
+
+### What Works
+- ✅ Dockerfile at `cmd/acb-enrichment/Dockerfile` is valid
+- ✅ WorkflowTemplate `acb-enrichment-build` exists in declarative-config
+- ✅ Deployment manifest at `manifests/acb-enrichment-deployment.yml` ready
+- ✅ Docker is available (v27.5.1)
+- ✅ ardenone-manager kubectl-proxy accessible (read-only)
+- ✅ rs-manager kubectl-proxy accessible (read-only)
+
+### What's Missing
+- ❌ **iad-ci kubeconfig** at `~/.kube/iad-ci.kubeconfig` (DOES NOT EXIST)
+- ❌ **Docker Hub credentials** for ronaldraygun account (config.json is empty)
+- ❌ **rs-manager kubeconfig** at `~/.kube/rs-manager.kubeconfig` (DOES NOT EXIST)
+- ❌ **ExternalSecret disabled** - `cluster-iad-ci-externalsecret.yml.disabled`
+
+## Why This Matters
+
+The acb-enrichment service deployment has a placeholder SHA (`sha256:placeholder`) that must be replaced with a real image digest. There are two paths to get a real image:
+
+### Path 1: CI/CD via Argo Workflows (iad-ci)
+- Submit workflow to `iad-ci` cluster
+- Kaniko builds image and pushes to Docker Hub
+- **Blocker:** No access to iad-ci cluster
+
+### Path 2: Local Docker Build
+- Build locally: `docker build -f cmd/acb-enrichment/Dockerfile -t ronaldraygun/acb-enrichment:sha-82ba466 .`
+- Push to Docker Hub
+- **Blocker:** No Docker Hub credentials for ronaldraygun account
+
+## Cluster Access Status
+
+| Cluster | Kubeconfig | Proxy | Argo Workflows |
+|---------|-----------|-------|----------------|
+| iad-ci | ❌ Missing | ❌ N/A | ✅ Yes (but no access) |
+| rs-manager | ❌ Missing | ✅ traefik-rs-manager:8001 | ❌ No |
+| ardenone-manager | ❌ Missing | ✅ traefik-ardenone-manager:8001 | ❌ No |
+
+## Evidence of Missing Credentials
+
+```bash
+$ ls ~/.kube/*.kubeconfig
+ls: cannot access '/home/coding/.kube/*.kubeconfig': No such file or directory
+
+$ cat ~/.docker/config.json
+{}  # Empty - no credentials
+
+$ kubectl --server=http://traefik-iad-ci:8001 version
+error: no such host
+```
+
+## ArgoCD Cluster Secret Status
+
+The ExternalSecret that should sync iad-ci credentials from OpenBao is DISABLED:
+- File: `/home/coding/declarative-config/k8s/ardenone-manager/argocd/cluster-iad-ci-externalsecret.yml.disabled`
+- OpenBao path: `secret/ardenone-manager/argocd/cluster-iad-ci`
+- This secret would create the ArgoCD cluster secret automatically
+
+## Docker Hub Image Status
+
+```bash
+$ curl -s https://hub.docker.com/v2/repositories/ronaldraygun/acb-enrichment/tags | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('count',0))"
+0  # No tags - image never successfully built/pushed
+```
+
+## Webhook Attempts
+
+Multiple commits attempted to trigger builds via webhook:
+- `87d0edb` - "ci: trigger acb-enrichment build (bf-22vc5)"
+- `ce82cb3` - "ci: trigger acb-enrichment build (bf-22vc5)"
+- `e228a4e` - "ci: trigger acb-enrichment build (bf-22vc5)"
+
+Webhook returns "success" but no image is produced (likely webhook fails silently or Argo Events cannot connect to iad-ci).
+
+## Required Actions (User)
+
+### Option A: Provide iad-ci Kubeconfig
+1. Log in to Rackspace Spot console
+2. Navigate to cluster: `hcp-de5bec10-ce14-4eed-a6f4-750f3fd3a89a.spot.rackspace.com`
+3. Download kubeconfig for ServiceAccount with cluster-admin
+4. Save to `/home/coding/.kube/iad-ci.kubeconfig`
+5. Verify: `kubectl --kubeconfig=/home/coding/.kube/iad-ci.kubeconfig get workflows -n argo-workflows`
+
+### Option B: Enable ExternalSecret
+1. Store credentials in OpenBao at `secret/ardenone-manager/argocd/cluster-iad-ci`:
+   - SERVER: `https://hcp-de5bec10-ce14-4eed-a6f4-750f3fd3a89a.spot.rackspace.com`
+   - BEARER_TOKEN: SA token from Rackspace Spot UI
+   - CA_DATA: base64-encoded CA certificate
+2. Enable secret: Rename `cluster-iad-ci-externalsecret.yml.disabled` → `cluster-iad-ci-externalsecret.yml`
+3. Push to declarative-config
+4. Wait for ExternalSecret to sync (creates cluster secret in ArgoCD)
+5. Submit workflow via ArgoCD or directly to iad-ci
+
+### Option C: Provide Docker Hub Credentials
+1. Provide credentials for `ronaldraygun` Docker Hub account
+2. Add to `~/.docker/config.json`:
+   ```json
+   {
+     "auths": {
+       "https://index.docker.io/v1/": {
+         "auth": "<base64(username:password)>"
+       }
+     }
+   }
+   ```
+3. Build and push locally
+
+## Files Ready (Once Unblocked)
+
+1. `/home/coding/declarative-config/k8s/apexalgo-iad/ai-code-battle/acb-enrichment-deployment.yml`
+   - Replace `sha256:placeholder` with actual image digest
+   - Currently enabled (not .disabled)
+
+2. Workflow ready to submit:
+   ```bash
+   kubectl --kubeconfig=/home/coding/.kube/iad-ci.kubeconfig create -f - <<EOF
+   apiVersion: argoproj.io/v1alpha1
+   kind: Workflow
+   metadata:
+     generateName: acb-enrichment-build-manual-
+     namespace: argo-workflows
+     annotations:
+       commit_sha: "82ba466"
+   spec:
+     workflowTemplateRef:
+       name: acb-enrichment-build
+   EOF
+   ```
+
+## Summary
+
+All code and infrastructure is in place. The blocker is purely credentials/access:
+- No iad-ci kubeconfig to submit/check workflows
+- No Docker Hub credentials to build/push manually
+- ExternalSecret that would auto-sync credentials is disabled
+
+This requires user action to provide credentials via one of the options above.
+
+---
+**Attempt Date**: 2026-06-04 14:30 UTC  
+**Current Commit**: 82ba466  
+**Status**: BLOCKED - Awaiting credentials