build: keep generated orientation brief local and untracked

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -1,66 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — ops-mason
-
-**Domain:** infotech  
-**Last synced:** 2026-10-18 10:56 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant
-Progress: 5/7 done  |  workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804`
-
-**Open tasks:**
-- ! Close the Kubernetes variant  `feb17422`
-- ! Submit CCRs from approved plans (RPF-WP-0061)  `ebc420c6`
-
-### Describe every stored credential so the store is navigable
-Progress: 2/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
-
-**Open tasks:**
-- ! Resolve the rest with their owners  `fff26914`
-  *(wait: operators/nextcloud base entry removed 2026-10-14 after the founder retired it. Remaining draft gaps still need their owners.)*
-- ! Make an undescribed path visible before it accumulates  `9a0cea06`
-  *(wait: After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.)*
-
-### Materialize SecurityCases from their type, with acceptance as the only gate
-Progress: 2/4 done  |  workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583`
-
-**Open tasks:**
-- ! T03 — Build from an accepted case  `f6ad0d3c`
-  *(wait: After T03, and only once a type fits: secrets-engine-openbao is a service (JWT) client, which oidc-browser-relying-party does not cover.)*
-- ► T02 — Render a construction plan from a case  `56cea6be`
-
-### Construct the fluid-telegram operator credential lane
-Progress: 4/6 done  |  workplan_id: `483e56d6-6601-5377-9066-66225214c046`
-
-**Open tasks:**
-- ! Hand off routing and keep the adapter lane separate  `09eae088`
-  *(wait: After T05 verification; only ops-warden activates the entry.)*
-- ► Verify capabilities and record metadata-only evidence  `4c205be7`
-
-### Check the target's readiness tier before a direct Kubernetes apply
-Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
-
-**Open tasks:**
-- ! Review on 2026-12-21  `49dd5f9a`
-  *(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
-
-### Place the KeyCape secrets-engine-openbao client secret in OpenBao
-Progress: 4/5 done  |  workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77`
-
-**Open tasks:**
-- ► Live lane proof and pointer route  `1b1a0566`
-
-## Inbox Hygiene
-
-**Stale unread:** 10 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 7 unread message(s) lack supersession chains.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.gitignore

@@ -13,3 +13,6 @@ __pycache__/
 
 # Local runtime audit trail -- not repo content
 audit/
+
+# Generated workstation orientation; keep local, regenerate from State Hub.
+/.custodian-brief.md

SCOPE.md

@@ -83,3 +83,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards
 and exact-scope secret scans remain in place. This is repository maintenance,
 not a runtime service, authorization decision, deployment or publication.
 Other index generators and hub-derived briefs retain their owner boundaries.
+
+
+## Local orientation brief
+
+`.custodian-brief.md` is a generated local orientation snapshot. It remains on
+disk for offline use and is root-ignored rather than versioned. Regenerate it
+with the State Hub brief renderer; workplans and other authored repository
+records remain authoritative. Brief refreshes must not create Git commits.