key-cape/.custodian-brief.md

<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — key-cape

**Domain:** infotech  
**Last synced:** 2026-10-14 22:10 UTC  
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

## Active Workstreams

### Negative-check tokens for the secrets-engine OpenBao JWT role
Progress: 2/3 done  |  workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`

**Open tasks:**
- ! T01 — Define the probe registrations  `03da4c38`
  *(wait: Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved.)*

### Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)
Progress: 0/2 done  |  workplan_id: `a67f9d60-9b8f-5111-9fe5-9f64e631b1c3`

**Open tasks:**
- ► Recovery preview rejects valid input (F6)  `b385602d`
- ► Link the OTP prompt to lost-authenticator help (F3)  `3ad155dd`

### Forgejo as a NetKingdom OIDC client, so the forge can close
Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`

**Open tasks:**
- ! T01 — Define what Forgejo receives  `ddcfb482`
  *(wait: Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout.)*
- ! T02 — Register the client and hand over its secret  `40ddaa29`
  *(wait: Claims are verified against the registered client.)*

### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)
Progress: 1/2 done  |  workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b`

**Open tasks:**
- ► Deploy the image and record its digest  `bd5db26c`

## Inbox Hygiene

**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 2 unread message(s) lack supersession chains.

---
## MCP Orientation (when available)

If the state-hub MCP server is reachable, call:
`get_domain_summary("infotech")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.