chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-10-03:
  - update .custodian-brief.md for ops-mason

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 01:29 UTC  
+**Last synced:** 2026-10-03 01:50 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,8 +12,11 @@ Progress: 2/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
 
 **Open tasks:**
 - ! Manifests in the tenant-engine rApp repository  `e56f0374`
+  *(wait: tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD.)*
 - ! Attended seed of the dedicated KV path  `1bb05319`
+  *(wait: Attended founder session: run railiance-platform scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role) under warden openbao-platform-admin-login, then a wrapped platform-admin process copies the tenant-engine token from the registry document to platform/workloads/tenant-engine/audit-core-sender without printing it; ops-mason-build is denied value reads, so only an attended admin lane can do it.)*
 - ! Verify and hand off  `84576093`
+  *(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)*
 - · Complete the live survey and review the plan  `1819909b`
 
 ### Describe every stored credential so the store is navigable
@@ -34,7 +37,7 @@ Progress: 0/6 done  |  workplan_id: `483e56d6-6601-5377-9066-66225214c046`
 
 **Open tasks:**
 - ! Confirm the path and OIDC identity binding  `18c9099f`
-  *(wait: railiance-platform must confirm the tenant/path segment and the KeyCape group claim.)*
+  *(wait: KeyCape/NetKingdom must confirm the OIDC group claim, assurance level and callbacks for the attended provisioner role; railiance-platform (2026-09-09) declines to decide these. Tenant/path acceptance moves to the plan approval (T03).)*
 - ! Review the plan and obtain the decision  `48a2b4ec`
   *(wait: Explicit human approval of the plan (status: approved, approved_by, approved_at) after the live survey.)*
 - ! Build the approved operator lane  `0e3d1333`