net-kingdom/.custodian-brief.md

<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — net-kingdom

**Domain:** infotech  
**Last synced:** 2026-09-28 21:47 UTC  
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

## Active Workstreams

### NetKingdom Security Pattern Tutorials
Progress: 2/6 done  |  workplan_id: `d4d02dbf-3974-502d-8b87-b776fc63e17e`

**Open tasks:**
- ► Document the existing OpenBao operating path  `16cf51a4`
- ► Document SSH certificates and tunnels  `1d28e3f1`
- ► Integrate a protected flex-auth consumer  `c380ef19`
- · Demonstrate temporary object credentials  `d13760fd`

### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`

**Open tasks:**
- · Admit the database consumer  `2fe6f100`
- · Package the broker deployment  `32d1411b`
- · Integrate an upstream identity provider  `6697a994`
- · Define federated assurance  `d845380d`
- · Verify IAM conformance and coexistence  `9cb7fd93`
- · Enforce tenant and platform boundaries  `38998c68`
- · Prove recovery and audit delivery  `e5f44ddc`
- … and 1 more open tasks

### Implement deterministic posture and evidence feedback
Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`

**Open tasks:**
- ! Obtain audit-core freshness adoption  `7d2029d2`
  *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)*

### Publish the NetKingdom emission-cadence security profile
Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`

**Open tasks:**
- ! Bind and hand off the published contract  `e3fbc8b8`
  *(wait: Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft.)*

### Reconcile reef placement and security-zone canon dependencies
Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`

**Open tasks:**
- ! T02 — Extend provider declarations to reefs  `5b35b646`
- ! T03 — Reconcile reef ceilings mechanically  `e3f0bb0f`
- ! T06 — Resolve the `DataClassification` mismatch  `bf8b3e1d`

### Let workloads require MFA for all or part of their features
Progress: 1/2 done  |  workplan_id: `3f702215-704b-5788-8ca0-b8b9ba2dd3f8`

**Open tasks:**
- ! Agree the user-facing step-up and enrollment journey  `4e51585d`
  *(wait: Agree the MFA-required user experience with user-engine and one pilot workload; must be accepted from a user's perspective.)*

### Cut over NetKingdom identity to railiance01 and retire CoulombCore
Progress: 7/8 done  |  workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`

**Open tasks:**
- ! T08 - Final deletion and closure  `42a3b4c0`

### Take in the flex-auth to access-engine repository-coordinate rename
Progress: 2/4 done  |  workplan_id: `284a8ac2-61dc-5bee-b74a-0a62d9808edb`

**Open tasks:**
- ! Update repository-coordinate references once access-engine resolves  `6e62919d`
  *(wait: Await the flex-auth announcement that coulomb/access-engine resolves (FLEX-WP-0020), then verify repository-coordinate references.)*
- ! Retire or reconcile the stale flex-auth/tenant-engine reference manifest  `2541f523`
  *(wait: Retire-vs-reconcile answer routed to flex-auth (2c637dc9) and tenant-engine (9fc740da); act on whichever returns, do not pre-empt.)*

### Define an execution-attribution receipt for Railiance runs
Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`

**Open tasks:**
- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
  *(wait: Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated.)*

---
## MCP Orientation (when available)

If the state-hub MCP server is reachable, call:
`get_domain_summary("infotech")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.