Add bounded resource audiences and enforce browser scope grants

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

.custodian-brief.md

@@ -2,18 +2,16 @@
 # Custodian Brief — key-cape
 
 **Domain:** infotech  
-**Last synced:** 2026-08-25 17:53 UTC  
+**Last synced:** 2026-09-04 22:33 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Approval-engine resource audience and client registrations
+Progress: 1/2 done  |  workplan_id: `6e815d88-b0e3-5ce0-be5d-13ab15917f7f`
 
-## Inbox Hygiene
-
-**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 1 unread message(s) lack supersession chains.
-- ! state-hub: [BREAKING] Task status canon: wait/todo/progress/done/cancel  `8dbd52c2`
+**Open tasks:**
+- ! Provision and prove live registrations  `607897c5`
 
 ---
 ## MCP Orientation (when available)