chore: keep generated orientation brief local

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

.custodian-brief.md

@@ -1,46 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — audit-core
-
-**Domain:** infotech  
-**Last synced:** 2026-10-10 11:23 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Validate canonical execution-attribution receipts on ingest
-Progress: 1/2 done  |  workplan_id: `687311f9-8830-5aac-b541-0c4f0413c9e6`
-
-**Open tasks:**
-- ! Implement and test canonical receipt validation  `33efb421`
-  *(wait: NetKingdom NK-WP-0040-T02 must return the versioned receipt schema, validator and fixtures; Railiance must confirm its emitting source and wire binding.)*
-
-### Complete flex-auth and Qonto sender admission
-Progress: 3/5 done  |  workplan_id: `9e400de2-6ba1-520e-9b25-94aa2470e528`
-
-**Open tasks:**
-- ! Admit six flex-auth pin identities and verify custody  `fff70081`
-  *(wait: flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied.)*
-- ! Admit the Qonto collector and verify accepted-class mapping  `76b59808`
-  *(wait: rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence.)*
-
-### Obtain independent chain-head and refreshed tenancy evidence
-Progress: 0/2 done  |  workplan_id: `ad0685fd-77cc-5415-afae-87ea7226b195`
-
-**Open tasks:**
-- ! Obtain independent offsite chain-head readback  `5fa2bfe4`
-  *(wait: resource-control and rapp-postgres must name a current chain-head custody owner/task and return offsite upload/readback receipts with cadence and failure handling.)*
-- ! Record refreshed E2 and asm-t08 owner prerequisites  `e8a9cd4f`
-  *(wait: access-engine must confirm a tenant-A flex-auth identity without tenant-B authority, or Whitehat must supply a separately approved future engagement; asm-t08 surface owner inputs remain missing.)*
-
-## Inbox Hygiene
-
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.gitignore

@@ -177,3 +177,6 @@ cython_debug/
 
 # Failure-matrix run artifacts; regenerate with `make failure-matrix`.
 evidence/*.json
+
+# Local State Hub orientation snapshot; authored work records remain tracked.
+/.custodian-brief.md

SCOPE.md

@@ -125,3 +125,9 @@ effect of its own.
 - Bound on what may be claimed: `docs/integrity.md`
 - Agent instructions: `AGENTS.md`
 - Workplans: `workplans/`
+
+## Local orientation brief policy — 2026-10-21
+
+`.custodian-brief.md` is a local, ignored State Hub orientation snapshot. Refreshing
+it does not require a Git commit. Authored workplans and the generated
+WORK-RECORDS index keep their existing source and staged-generation contracts.

workplans/AUDIT-WP-0016-wave2-resource-right-sizing.md

@@ -0,0 +1,54 @@
+---
+id: AUDIT-WP-0016
+type: workplan
+title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
+domain: infotech
+repo: audit-core
+status: ready
+flavor: implementation
+owner: claude
+topic_slug: audit-evidence-dependencies
+created: "2026-10-21"
+updated: "2026-10-21"
+related:
+  - CUST-WP-0071
+  - RESOURCE-WP-0008
+---
+
+# AUDIT-WP-0016 — Wave-2 resource right-sizing from the 2026-10-21 allocation review
+
+Receiving workplan in `audit-core` for the wave-2 request changes below.
+
+Origin: the 2026-10-21 node allocation review (`RESOURCE-WP-0008-T03`, feeding `CUST-WP-0071-T03`). Per the founder's 2026-10-21 delivery interview (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`) the small adjustments form wave 2: one receiving task per owner repo, applied later in a batch. Applying wave 2 needs a separate founder approval, so every cluster-write task here is a human-gated `wait`. This file changes no manifest.
+
+## Apply the reviewed request changes
+
+```task
+id: AUDIT-WP-0016-T01
+status: wait
+priority: medium
+needs_human: true
+blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
+```
+
+Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.
+
+| Workload (ns/name) | Pods | CPU request | CPU limit | CPU p95/peak 7d (m) | Memory request | Memory limit | Mem p95/peak (Mi) | Throttle | Action |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---|
+| `audit-core/audit-core` | 1 | 50m → **10m** | 500m | 1.5/12.2 | 64Mi → **64Mi** | 256Mi | 26.4/26.6 | 0.001 | decrease |
+
+Source and container detail:
+
+- `audit-core/audit-core`: Deployment `audit-core`, container `audit-core`, `deploy/audit-core.yaml` (50m/64Mi, limits 500m/256Mi).
+
+Evidence: resource-control `docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md` (+ `.json`, commit `3d9b1bd`). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).
+
+Steps:
+
+1. Map the pod-aggregate proposal onto the named container(s) in the source file; where a workload has several containers or pods, split by the per-pod figures in `2026-10-21-workload-usage.json` and keep the sum at the proposed value.
+2. Prepare the source change as a reviewed commit (no push, no sync) and record the before values here.
+3. Apply only inside the batched wave-2 rollout, after founder approval, through the owner's normal deploy path (ArgoCD sync or documented helm/kubectl apply).
+
+Verification: `kubectl -n <ns> get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
+
+Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.