From a310f3fe3589a122270270d167676b9e3b7a5c73 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 13:44:05 +0200 Subject: [PATCH] build: keep generated orientation brief local and untracked Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- .custodian-brief.md | 67 --------------------------------------------- .gitignore | 3 ++ SCOPE.md | 8 ++++++ 3 files changed, 11 insertions(+), 67 deletions(-) delete mode 100644 .custodian-brief.md diff --git a/.custodian-brief.md b/.custodian-brief.md deleted file mode 100644 index 5e12ebd..0000000 --- a/.custodian-brief.md +++ /dev/null @@ -1,67 +0,0 @@ - -# Custodian Brief — access-engine - -**Domain:** infotech -**Last synced:** 2026-10-16 14:30 UTC -**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* - -## Active Workstreams - -### Sign the decision envelope: the response channel is unauthenticated -Progress: 5/6 done | workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27` - -**Open tasks:** -- ► 6. Admit custody, consumer trust, exact packages and native signed decisions `7f785b52` - -### The decision record has a declared emission guarantee and nothing that delivers it -Progress: 5/9 done | workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095` - -**Open tasks:** -- ! 2. Register flex-auth as an audit-core sender `89661908` - *(wait: GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.)* -- ! 4. Close G2 `423b3090` - *(wait: G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.)* -- ! 6. Reconciliation, profile check, and storage `bf92a951` - *(wait: Receiver counts use accepted_at, while local counts use commit time; audit-core must supply compatible window semantics or durable acceptance timestamps before a valid comparator can be implemented.)* -- ! 8. Admit and exercise native heartbeat/drain delivery `b3b52b30` - *(wait: Needs admitted sender/token mounts, founder approval of exact image/PVC/network rollout, and audit-core observer evidence; no production delivery is enabled.)* - -### Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time -Progress: 0/8 done | workplan_id: `af0f8d77-af04-569b-8e79-6c47eb8f1087` - -**Open tasks:** -- ! Decide the target names and supersede the retain table `4f9a796d` -- ! Make the PDP accept both names `487525e5` -- ! Rename the source `ff7fd369` -- ! Stand up the access-engine namespace next to flex-auth `13b93d7a` -- ! Consumers switch over, one at a time `f0470e5c` -- ► Inventory every consumer reference and open handoffs `8f597899` -- · Retire the flex-auth runtime `e46c9c8e` -- … and 1 more open tasks - -### Repository identity migration from flex-auth to access-engine -Progress: 10/11 done | workplan_id: `99a661a8-b36c-5c1c-b78b-1e8930bcd0a9` - -**Open tasks:** -- ! 11. Soak, hand off residuals, and clean up the old checkout `46d8318b` - *(wait: Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.)* - -### 2026-10-03 secret-read evaluator for ops-warden fetch checks -Progress: 1/2 done | workplan_id: `60941288-d1f8-58fe-ad38-d508b7d5eac2` - -**Open tasks:** -- ! Deploy the pin (founder go required) `aa00b29f` - *(wait: Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.)* - -## Inbox Hygiene - -**Stale unread:** 5 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 2 unread message(s) lack supersession chains. - ---- -## MCP Orientation (when available) - -If the state-hub MCP server is reachable, call: -`get_domain_summary("infotech")` -This provides richer cross-domain context. -If the MCP call fails, use this file as your orientation source. diff --git a/.gitignore b/.gitignore index 841cea9..c8e18c4 100644 --- a/.gitignore +++ b/.gitignore @@ -180,3 +180,6 @@ cython_debug/ # PyPI configuration file .pypirc + +# Generated workstation orientation; keep local, regenerate from State Hub. +/.custodian-brief.md diff --git a/SCOPE.md b/SCOPE.md index 7230546..110a67e 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -368,3 +368,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards and exact-scope secret scans remain in place. This is repository maintenance, not a runtime service, authorization decision, deployment or publication. Other index generators and hub-derived briefs retain their owner boundaries. + + +## Local orientation brief + +`.custodian-brief.md` is a generated local orientation snapshot. It remains on +disk for offline use and is root-ignored rather than versioned. Regenerate it +with the State Hub brief renderer; workplans and other authored repository +records remain authoritative. Brief refreshes must not create Git commits.