hub-core/.custodian-brief.md

<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — hub-core

**Domain:** infotech  
**Last synced:** 2026-09-28 21:50 UTC  
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

## Active Workstreams

### State Hub inbox freshness and reader cutover
Progress: 0/3 done  |  workplan_id: `3c8034fc-fd90-58f5-99bc-99b4f93e5ee1`

**Open tasks:**
- ! Admit the actual reader identity and full scope semantics  `35c5ae8b`
- ! Execute one reviewed client switch  `61c727a5`
- · Establish ongoing inbox freshness  `588e4b58`

### Repository classification aggregation and navigation
Progress: 5/6 done  |  workplan_id: `05ebd06e-4af8-5f6c-918c-c143c1520e00`

**Open tasks:**
- ! Hand A5/A4 navigation to State Hub retirement  `7c8225f7`
  *(wait: Waits on T02-T05 and the State Hub cutover window under STATE-WP-0079.)*

### NetKingdom identity and tenant integration: platform-root first
Progress: 0/8 done  |  workplan_id: `e61ce290-c5ec-516c-8589-ef9a55cf3aa3`

**Open tasks:**
- ! T01 — Freeze the integration contract and platform coverage matrix  `204f4fb0`
  *(wait: Contract reviewers' (NetKingdom, user-engine, tenant-engine, flex-auth) sign-off on the inventory and disputed rows)*
- ! T02 — Bind platform-root identity, login, tenant and revocation  `9a955fbf`
  *(wait: NetKingdom/KeyCape live root login, AAL2 enrollment acceptance, and User/Tenant Engine authenticated HTTP readers (contract published in docs/owner-facts-contract.md, no owner endpoint admitted yet))*
- ! T03 — Deliver root policy and authenticated decision evaluation  `feea8f20`
  *(wait: flex-auth production PDP deployment and signing-key delivery from platform owners (audit-core-senders routing entry to ops-mason/OpenBao is unresolved; no Hub sender credential minted))*
- ! T04 — Enforce the boundary across Hub Core and its clients  `15bc3cae`
  *(wait: T02/T03 live admission; private full-root browser/API/MCP journeys need a real root login and PDP, which do not exist yet)*
- ! T05 — Admit extensions and State Hub migration callers  `6d29854e`
  *(wait: T04 live admission)*
- ! T06 — Prove full platform-root coverage, including Railiance (M1)  `97b0b242`
  *(wait: T04/T05 live admission and Railiance/platform owners' attended receipts)*
- ! T07 — Package and gate public exposure  `0c15cb82`
  *(wait: M1 acceptance; owner: rapp-core-hub via RAPPCOREHUB-WP-0002-T05)*
- … and 1 more open tasks

---
## MCP Orientation (when available)

If the state-hub MCP server is reachable, call:
`get_domain_summary("infotech")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.