build: keep generated orientation brief local and untracked

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -1,67 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — access-engine
-
-**Domain:** infotech  
-**Last synced:** 2026-10-16 14:30 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Sign the decision envelope: the response channel is unauthenticated
-Progress: 5/6 done  |  workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27`
-
-**Open tasks:**
-- ► 6. Admit custody, consumer trust, exact packages and native signed decisions  `7f785b52`
-
-### The decision record has a declared emission guarantee and nothing that delivers it
-Progress: 5/9 done  |  workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095`
-
-**Open tasks:**
-- ! 2. Register flex-auth as an audit-core sender  `89661908`
-  *(wait: GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.)*
-- ! 4. Close G2  `423b3090`
-  *(wait: G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.)*
-- ! 6. Reconciliation, profile check, and storage  `bf92a951`
-  *(wait: Receiver counts use accepted_at, while local counts use commit time; audit-core must supply compatible window semantics or durable acceptance timestamps before a valid comparator can be implemented.)*
-- ! 8. Admit and exercise native heartbeat/drain delivery  `b3b52b30`
-  *(wait: Needs admitted sender/token mounts, founder approval of exact image/PVC/network rollout, and audit-core observer evidence; no production delivery is enabled.)*
-
-### Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time
-Progress: 0/8 done  |  workplan_id: `af0f8d77-af04-569b-8e79-6c47eb8f1087`
-
-**Open tasks:**
-- ! Decide the target names and supersede the retain table  `4f9a796d`
-- ! Make the PDP accept both names  `487525e5`
-- ! Rename the source  `ff7fd369`
-- ! Stand up the access-engine namespace next to flex-auth  `13b93d7a`
-- ! Consumers switch over, one at a time  `f0470e5c`
-- ► Inventory every consumer reference and open handoffs  `8f597899`
-- · Retire the flex-auth runtime  `e46c9c8e`
-- … and 1 more open tasks
-
-### Repository identity migration from flex-auth to access-engine
-Progress: 10/11 done  |  workplan_id: `99a661a8-b36c-5c1c-b78b-1e8930bcd0a9`
-
-**Open tasks:**
-- ! 11. Soak, hand off residuals, and clean up the old checkout  `46d8318b`
-  *(wait: Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.)*
-
-### 2026-10-03 secret-read evaluator for ops-warden fetch checks
-Progress: 1/2 done  |  workplan_id: `60941288-d1f8-58fe-ad38-d508b7d5eac2`
-
-**Open tasks:**
-- ! Deploy the pin (founder go required)  `aa00b29f`
-  *(wait: Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.)*
-
-## Inbox Hygiene
-
-**Stale unread:** 5 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.gitignore

@@ -180,3 +180,6 @@ cython_debug/
 # PyPI configuration file
 .pypirc
 
+
+# Generated workstation orientation; keep local, regenerate from State Hub.
+/.custodian-brief.md

SCOPE.md

@@ -368,3 +368,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards
 and exact-scope secret scans remain in place. This is repository maintenance,
 not a runtime service, authorization decision, deployment or publication.
 Other index generators and hub-derived briefs retain their owner boundaries.
+
+
+## Local orientation brief
+
+`.custodian-brief.md` is a generated local orientation snapshot. It remains on
+disk for offline use and is root-ignored rather than versioned. Regenerate it
+with the State Hub brief renderer; workplans and other authored repository
+records remain authoritative. Brief refreshes must not create Git commits.