diff --git a/REFACTORING-AUDIT.md b/REFACTORING-AUDIT.md
index 56d63db..418a8c0 100644
--- a/REFACTORING-AUDIT.md
+++ b/REFACTORING-AUDIT.md
@@ -286,6 +286,7 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 - Extracted OTP template parameter decoding into the same application package and kept persistence JSON types at the infrastructure boundary; full Auth tests pass in `62fb1b1`.
 - Extracted the three-attempt retry and already-used verification policy into `application/otp`; the gRPC use-case retains compatible status/error mapping and full tests pass in `133fcc3`.
 - Added explicit OTP `Store` and `Sender` application contracts, isolating persistence and delivery concerns for the next adapter migration; full Auth tests pass in `8fbfcff`.
+- Added concrete infrastructure adapters for the Redis OTP store and Kavenegar sender while preserving existing key/TTL behavior; full Auth tests pass in `cde73ef`.
 - A004 remains in progress: template lookup, delivery, verification, and thin gRPC adapter extraction still use the legacy use-case/repository composition.
 
 ### `I001` — publisher-backed ICO purchase map
diff --git a/REFACTORING-TODO.md b/REFACTORING-TODO.md
index 7642d58..5602607 100644
--- a/REFACTORING-TODO.md
+++ b/REFACTORING-TODO.md
@@ -107,7 +107,7 @@ This is the authoritative execution tracker for the refactor. Work is performed
 | A001 | `DONE` | Map every auth RPC to business operations and dependencies. | Method-level migration map is recorded in `REFACTORING-AUDIT.md`; completed on `2026-08-30`. |
 | A002 | `DONE` | Introduce auth domain entities, value objects, errors, and repository ports. | Added pure Auth entities/value objects, domain errors, and inward-facing repository/cache ports with no gRPC, GORM, Redis, or framework imports; committed as `32f182b`/`d292822`. |
 | A003 | `STARTED` | Move auth persistence and Redis implementations into infrastructure. | Explicit mappings and domain-port adapters now cover users, identities, sessions, permissions, roles, role-permissions, bank information, OTP templates, and cache; legacy repository integration and ownership migration remain. |
-| A004 | `STARTED` | Extract OTP application use cases and thin gRPC adapters. | OTP generation, expiration, template parsing, retry/verification policy, and store/sender contracts are application primitives; concrete adapters remain. |
+| A004 | `STARTED` | Extract OTP application use cases and thin gRPC adapters. | OTP generation, expiration, template parsing, retry/verification policy, and store/sender contracts plus Redis/provider adapters are extracted; wiring and gRPC adapter extraction remain. |
 | A005 | `TODO` | Extract authentication/JWT application use cases and adapters. | Token behavior, validation, and status mapping remain compatible. |
 | A006 | `TODO` | Extract identity and permission use cases and adapters. | Public and internal authorization services pass tests. |
 | A007 | `TODO` | Replace auth bootstrap with explicit dependency composition. | Dependency direction is enforced and the service builds. |
@@ -293,3 +293,4 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | A004 | `STARTED` | `STARTED` | Extracted OTP template parameter decoding into `application/otp`; full Auth tests pass in `62fb1b1`. Legacy template lookup and delivery composition remain. |
 | 2026-08-30 | A004 | `STARTED` | `STARTED` | Extracted OTP retry/verification policy into `application/otp`; full Auth tests pass in `133fcc3`. Legacy persistence and gRPC composition remain. |
 | 2026-08-30 | A004 | `STARTED` | `STARTED` | Added transport-independent OTP store and sender contracts in `application/otp`; full Auth tests pass in `8fbfcff`. Concrete Redis/provider adapters remain. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Added concrete Redis-backed OTP store and Kavenegar sender adapters under `infrastructure/otp`; full Auth tests pass in `cde73ef`. Runtime wiring and gRPC adapter extraction remain. |