chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-10-03:
  - update .custodian-brief.md for net-kingdom

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

.custodian-brief.md

@@ -2,48 +2,55 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 20:00 UTC  
+**Last synced:** 2026-10-03 20:21 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
-Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
-
-**Open tasks:**
-- · Admit the database consumer  `2fe6f100`
-- · Package the broker deployment  `32d1411b`
-- · Integrate an upstream identity provider  `6697a994`
-- · Define federated assurance  `d845380d`
-- · Verify IAM conformance and coexistence  `9cb7fd93`
-- · Enforce tenant and platform boundaries  `38998c68`
-- · Prove recovery and audit delivery  `e5f44ddc`
-- … and 1 more open tasks
-
 ### Implement deterministic posture and evidence feedback
 Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
 
 **Open tasks:**
 - ! Obtain audit-core freshness adoption  `7d2029d2`
-  *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)*
+  *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
 
 ### Publish the NetKingdom emission-cadence security profile
 Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
 
 **Open tasks:**
 - ! Bind and hand off the published contract  `e3fbc8b8`
-  *(wait: Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft.)*
+  *(wait: InfoTechCanon publication is delivered and bound. Waiting on Approval Engine/Qonto owner envelope migration, local-identity incompatibility disposition, actual audit-core observer evidence and Kings Guard handoff.)*
 
 ### Reconcile reef placement and security-zone canon dependencies
 Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
 
 **Open tasks:**
 - ! T02 — Extend provider declarations to reefs  `5b35b646`
-  *(wait: Proposal to repo-manager: extend Decision 5.5 provider declaration to substrate providers.)*
+  *(wait: Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.)*
 - ! T03 — Reconcile reef ceilings mechanically  `e3f0bb0f`
   *(wait: Mechanical join of reef ceilings to consumer V declarations waits on T02.)*
 - ! T06 — Resolve the `DataClassification` mismatch  `bf8b3e1d`
-  *(wait: DataClassification vocabulary mismatch between rapp-policy-nexus (public) and ops-warden dataclass_floor must be resolved with those owners.)*
+  *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)*
+
+### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
+Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
+
+**Open tasks:**
+- ! Admit the database consumer  `2fe6f100`
+  *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
+- ! Package the broker deployment  `32d1411b`
+  *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
+- ! Integrate an upstream identity provider  `6697a994`
+  *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
+- ! Define federated assurance  `d845380d`
+  *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
+- ! Verify IAM conformance and coexistence  `9cb7fd93`
+  *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
+- ! Enforce tenant and platform boundaries  `38998c68`
+  *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
+- ! Prove recovery and audit delivery  `e5f44ddc`
+  *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
+- … and 1 more open tasks
 
 ### Let workloads require MFA for all or part of their features
 Progress: 1/2 done  |  workplan_id: `3f702215-704b-5788-8ca0-b8b9ba2dd3f8`
@@ -64,7 +71,7 @@ Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
 
 **Open tasks:**
 - ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
-  *(wait: Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated.)*
+  *(wait: Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence.)*
 
 ---
 ## MCP Orientation (when available)