build: adopt staged records and retain reviewed orientation snapshot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -2,17 +2,23 @@
 # Custodian Brief — access-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-10-11 18:38 UTC  
+**Last synced:** 2026-10-16 14:30 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Sign the decision envelope: the response channel is unauthenticated
+Progress: 5/6 done  |  workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27`
+
+**Open tasks:**
+- ► 6. Admit custody, consumer trust, exact packages and native signed decisions  `7f785b52`
+
 ### The decision record has a declared emission guarantee and nothing that delivers it
 Progress: 5/9 done  |  workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095`
 
 **Open tasks:**
 - ! 2. Register flex-auth as an audit-core sender  `89661908`
-  *(wait: AUDIT-IN-0006 sender rows and governed token delivery remain pending; gate-house GH-WP-0004-T12 must rule on the load-bearing failure-path exception.)*
+  *(wait: GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.)*
 - ! 4. Close G2  `423b3090`
   *(wait: G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.)*
 - ! 6. Reconciliation, profile check, and storage  `bf92a951`
@@ -24,12 +30,12 @@ Progress: 5/9 done  |  workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095`
 Progress: 0/8 done  |  workplan_id: `af0f8d77-af04-569b-8e79-6c47eb8f1087`
 
 **Open tasks:**
-- ► Decide the target names and supersede the retain table  `4f9a796d`
+- ! Decide the target names and supersede the retain table  `4f9a796d`
+- ! Make the PDP accept both names  `487525e5`
+- ! Rename the source  `ff7fd369`
+- ! Stand up the access-engine namespace next to flex-auth  `13b93d7a`
+- ! Consumers switch over, one at a time  `f0470e5c`
 - ► Inventory every consumer reference and open handoffs  `8f597899`
-- ► Rename the source  `ff7fd369`
-- · Make the PDP accept both names  `487525e5`
-- · Stand up the access-engine namespace next to flex-auth  `13b93d7a`
-- · Consumers switch over, one at a time  `f0470e5c`
 - · Retire the flex-auth runtime  `e46c9c8e`
 - … and 1 more open tasks
 
@@ -38,18 +44,18 @@ Progress: 10/11 done  |  workplan_id: `99a661a8-b36c-5c1c-b78b-1e8930bcd0a9`
 
 **Open tasks:**
 - ! 11. Soak, hand off residuals, and clean up the old checkout  `46d8318b`
-  *(wait: Needs SBOM-IN-0001 catch-up receipt, secrets-engine coordinate correction and railiance-fabric residual disposition, observed soak evidence, and exact checkout cleanup approval under e071b34e-c4d4-49d0-824d-2c58bb0ae496.)*
+  *(wait: Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.)*
 
 ### 2026-10-03 secret-read evaluator for ops-warden fetch checks
 Progress: 1/2 done  |  workplan_id: `60941288-d1f8-58fe-ad38-d508b7d5eac2`
 
 **Open tasks:**
 - ! Deploy the pin (founder go required)  `aa00b29f`
-  *(wait: Live railiance01 change; founder go needed for CI image digest, helm install and tunnel.)*
+  *(wait: Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.)*
 
 ## Inbox Hygiene
 
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Stale unread:** 5 message(s) older than 3 day(s) — triage at session start.
 **Missing thread_id:** 2 unread message(s) lack supersession chains.
 
 ---

.generated-work-records.json

@@ -0,0 +1 @@
+{"version":1,"repo_slug":"access-engine"}

.generated-work-records.mk

@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= access-engine
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check

Makefile

@@ -86,3 +86,10 @@ decisionpep-export:
 decisionpep-check:
 	python3 tools/export_decisionpep_adapter.py --check
 	go test ./pkg/decisionpep
+
+# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
+generated-work-records-check:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check

SCOPE.md

@@ -351,3 +351,20 @@ title: Layer declaration
 status: current
 description: Machine-readable Engine/PDP boundary declaration in INTENT.md frontmatter, carrying no standard version by design, with version-stamped conformance state and three declared gaps (G2 a ruled §11 non-conformance) and a per-event-class emission declaration in cadence.yaml, per docs/conformance/security-layer-conformance.md, per Security Layer Model section 11.
 ```
+
+
+## Repository maintenance reuse
+
+The tracked `.generated-work-records.json` adopts the Custodian staged-source
+adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing
+State Hub renderer through `.generated-work-records.mk`; the shared pre-commit
+hook runs this isolated recipe only for opted-in repositories. The corresponding
+`make generated-work-records-check` is read-only. Canonical repository identity
+is explicit and does not depend on the checkout directory.
+
+Unstaged source changes are preserved; conflicts and unstaged generated-file
+changes stop the commit. For `git commit --only`, generate first and include
+WORK-RECORDS.md with the selected source paths. Existing generated-only guards
+and exact-scope secret scans remain in place. This is repository maintenance,
+not a runtime service, authorization decision, deployment or publication.
+Other index generators and hub-derived briefs retain their owner boundaries.

WORK-RECORDS.md

@@ -33,7 +33,7 @@
 | workplan | FLEX-WP-0021 | finished | — | workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md |
 | workplan | FLEX-WP-0022 | finished | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
 | workplan | FLEX-WP-0023 | finished | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
-| workplan | FLEX-WP-0024 | finished | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
+| workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
 | workplan | FLEX-WP-0027 | finished | — | workplans/FLEX-WP-0027-t03-human-review.md |
@@ -168,6 +168,8 @@
 | task | FLEX-WP-0024-T02 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | task | FLEX-WP-0024-T03 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | task | FLEX-WP-0024-T04 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
+| task | FLEX-WP-0024-T05 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
+| task | FLEX-WP-0024-T06 | progress | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | task | FLEX-WP-0025-T01 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | task | FLEX-WP-0025-T02 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | task | FLEX-WP-0025-T03 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
@@ -214,12 +216,12 @@
 | task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | task | FLEX-WP-0035-T04 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | task | FLEX-WP-0035-T05 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
-| task | FLEX-WP-0036-T01 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
+| task | FLEX-WP-0036-T01 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | task | FLEX-WP-0036-T02 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
-| task | FLEX-WP-0036-T03 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
+| task | FLEX-WP-0036-T03 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
-| task | FLEX-WP-0036-T04 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
+| task | FLEX-WP-0036-T04 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
-| task | FLEX-WP-0036-T05 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
+| task | FLEX-WP-0036-T05 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
-| task | FLEX-WP-0036-T06 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
+| task | FLEX-WP-0036-T06 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |