diff --git a/.custodian-brief.md b/.custodian-brief.md deleted file mode 100644 index e340b7e..0000000 --- a/.custodian-brief.md +++ /dev/null @@ -1,66 +0,0 @@ - -# Custodian Brief — ops-mason - -**Domain:** infotech -**Last synced:** 2026-10-18 10:56 UTC -**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* - -## Active Workstreams - -### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant -Progress: 5/7 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804` - -**Open tasks:** -- ! Close the Kubernetes variant `feb17422` -- ! Submit CCRs from approved plans (RPF-WP-0061) `ebc420c6` - -### Describe every stored credential so the store is navigable -Progress: 2/4 done | workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c` - -**Open tasks:** -- ! Resolve the rest with their owners `fff26914` - *(wait: operators/nextcloud base entry removed 2026-10-14 after the founder retired it. Remaining draft gaps still need their owners.)* -- ! Make an undescribed path visible before it accumulates `9a0cea06` - *(wait: After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.)* - -### Materialize SecurityCases from their type, with acceptance as the only gate -Progress: 2/4 done | workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583` - -**Open tasks:** -- ! T03 — Build from an accepted case `f6ad0d3c` - *(wait: After T03, and only once a type fits: secrets-engine-openbao is a service (JWT) client, which oidc-browser-relying-party does not cover.)* -- ► T02 — Render a construction plan from a case `56cea6be` - -### Construct the fluid-telegram operator credential lane -Progress: 4/6 done | workplan_id: `483e56d6-6601-5377-9066-66225214c046` - -**Open tasks:** -- ! Hand off routing and keep the adapter lane separate `09eae088` - *(wait: After T05 verification; only ops-warden activates the entry.)* -- ► Verify capabilities and record metadata-only evidence `4c205be7` - -### Check the target's readiness tier before a direct Kubernetes apply -Progress: 5/6 done | workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5` - -**Open tasks:** -- ! Review on 2026-12-21 `49dd5f9a` - *(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)* - -### Place the KeyCape secrets-engine-openbao client secret in OpenBao -Progress: 4/5 done | workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77` - -**Open tasks:** -- ► Live lane proof and pointer route `1b1a0566` - -## Inbox Hygiene - -**Stale unread:** 10 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 7 unread message(s) lack supersession chains. - ---- -## MCP Orientation (when available) - -If the state-hub MCP server is reachable, call: -`get_domain_summary("infotech")` -This provides richer cross-domain context. -If the MCP call fails, use this file as your orientation source. diff --git a/.gitignore b/.gitignore index bbc42b3..afa346b 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,6 @@ __pycache__/ # Local runtime audit trail -- not repo content audit/ + +# Generated workstation orientation; keep local, regenerate from State Hub. +/.custodian-brief.md diff --git a/SCOPE.md b/SCOPE.md index 4aaa0e6..b5e4ce5 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -83,3 +83,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards and exact-scope secret scans remain in place. This is repository maintenance, not a runtime service, authorization decision, deployment or publication. Other index generators and hub-derived briefs retain their owner boundaries. + + +## Local orientation brief + +`.custodian-brief.md` is a generated local orientation snapshot. It remains on +disk for offline use and is root-ignored rather than versioned. Regenerate it +with the State Hub brief renderer; workplans and other authored repository +records remain authoritative. Brief refreshes must not create Git commits.