chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-10-04:
  - update .custodian-brief.md for audit-core

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-465c-7d43-8c4c-d10f0a1feadd

.custodian-brief.md

@@ -2,36 +2,42 @@
 # Custodian Brief — audit-core
 
 **Domain:** infotech  
-**Last synced:** 2026-10-04 09:31 UTC  
+**Last synced:** 2026-10-04 09:37 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Obtain independent chain-head and refreshed tenancy evidence
-Progress: 0/2 done  |  workplan_id: `ad0685fd-77cc-5415-afae-87ea7226b195`
-
-**Open tasks:**
-- ! Obtain independent offsite chain-head readback  `5fa2bfe4`
-- ! Record refreshed E2 and asm-t08 owner prerequisites  `e8a9cd4f`
-
 ### Validate canonical execution-attribution receipts on ingest
 Progress: 1/2 done  |  workplan_id: `687311f9-8830-5aac-b541-0c4f0413c9e6`
 
 **Open tasks:**
 - ! Implement and test canonical receipt validation  `33efb421`
+  *(wait: NetKingdom NK-WP-0040-T02 must return the versioned receipt schema, validator and fixtures; Railiance must confirm its emitting source and wire binding.)*
 
 ### Complete flex-auth and Qonto sender admission
 Progress: 2/5 done  |  workplan_id: `9e400de2-6ba1-520e-9b25-94aa2470e528`
 
 **Open tasks:**
 - ! Admit six flex-auth pin identities and verify custody  `fff70081`
+  *(wait: flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied.)*
 - ! Resolve the load-bearing failure-path declaration  `310e28d2`
+  *(wait: Gate House GH-WP-0004-T12 must supply the final decision and any canonical failure-path declaration shape.)*
 - ! Admit the Qonto collector and verify accepted-class mapping  `76b59808`
+  *(wait: rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence.)*
+
+### Obtain independent chain-head and refreshed tenancy evidence
+Progress: 0/2 done  |  workplan_id: `ad0685fd-77cc-5415-afae-87ea7226b195`
+
+**Open tasks:**
+- ! Obtain independent offsite chain-head readback  `5fa2bfe4`
+  *(wait: resource-control and rapp-postgres must name a current chain-head custody owner/task and return offsite upload/readback receipts with cadence and failure handling.)*
+- ! Record refreshed E2 and asm-t08 owner prerequisites  `e8a9cd4f`
+  *(wait: access-engine must confirm a tenant-A flex-auth identity without tenant-B authority, or Whitehat must supply a separately approved future engagement; asm-t08 surface owner inputs remain missing.)*
 
 ## Inbox Hygiene
 
-**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 4 unread message(s) lack supersession chains.
+**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)

workplans/AUDIT-WP-0013-cross-repo-sender-admission.md

@@ -76,4 +76,3 @@ state_hub_task_id: "76b59808-abc3-5b8d-b31a-e3fb611f2cbe"
 ```
 
 QONTO-WP-0006-T02. Audit-core owns admission and review of accepted mapping; rapp-qonto owns runtime delivery. Required inputs and proposed audit.allow/audit.deny/audit.heartbeat mapping are in docs/cross-repo-evidence-admission.md. Retain original stream instance, sequence and source counts. Approve deterministic retry IDs, heartbeat vouched-for class, authoritative tenant and acceptance-time/sequence-window comparison. Supply pinned collector/runtime artifacts, sanitized success/failure receipts and actual accepted records. Neither source stdout nor finished RAPP-QONTO-WP-0003 closes this gate. KG-WP-0005-T03 observer acceptance follows sender proof, never precedes it.
-

workplans/AUDIT-WP-0014-execution-attribution-receipt.md

@@ -39,4 +39,3 @@ state_hub_task_id: "33efb421-8dd7-5311-8447-9d6ca00992ba"
 ```
 
 Return artifact paths/digests, unknown/optional semantics and positive/negative fixtures covering every proposed receipt field. Railiance returns source/type, run-id/idempotency binding, scope, classification/cadence and custody policies. Then enforce canonical data validation and tenant equality before acceptance; test malformed content, secret withholding, duplicate/conflict and unchanged unknowns. Generic JSON storage is not canonical receipt validation. No local substitute schema or default actor is fabricated.
-

workplans/AUDIT-WP-0015-independent-evidence-returns.md

@@ -41,4 +41,3 @@ state_hub_task_id: "e8a9cd4f-0267-524a-8ddd-5e1cec33e3af"
 ```
 
 WHITEHAT-WP-0006-T03 stays wait. Prior -01/-02/-03 engagements are terminal; Whitehat requested no run. The alternative confirmation is access-engine-owned. asm-t08 needs its surface owner to name component revision, identities, window and technique. Preserve historical AUDIT-WP-0008-T05 completion and exact whitehat-security commit 7b5bc1e444cf57ae5d9ba1dac0c0189c0833e278. No engagement is minted, live run approved or packet sent. Requirements are recorded in docs/cross-repo-evidence-admission.md.
-