From ec103362553373143945e8ef822fe0d13e0973fc Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 3 Oct 2026 03:50:18 +0200 Subject: [PATCH] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-10-03: - update .custodian-brief.md for ops-mason Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- .custodian-brief.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 2370147..3e782b7 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — ops-mason **Domain:** infotech -**Last synced:** 2026-10-03 01:29 UTC +**Last synced:** 2026-10-03 01:50 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -12,8 +12,11 @@ Progress: 2/6 done | workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262` **Open tasks:** - ! Manifests in the tenant-engine rApp repository `e56f0374` + *(wait: tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD.)* - ! Attended seed of the dedicated KV path `1bb05319` + *(wait: Attended founder session: run railiance-platform scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role) under warden openbao-platform-admin-login, then a wrapped platform-admin process copies the tenant-engine token from the registry document to platform/workloads/tenant-engine/audit-core-sender without printing it; ops-mason-build is denied value reads, so only an attended admin lane can do it.)* - ! Verify and hand off `84576093` + *(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)* - · Complete the live survey and review the plan `1819909b` ### Describe every stored credential so the store is navigable @@ -34,7 +37,7 @@ Progress: 0/6 done | workplan_id: `483e56d6-6601-5377-9066-66225214c046` **Open tasks:** - ! Confirm the path and OIDC identity binding `18c9099f` - *(wait: railiance-platform must confirm the tenant/path segment and the KeyCape group claim.)* + *(wait: KeyCape/NetKingdom must confirm the OIDC group claim, assurance level and callbacks for the attended provisioner role; railiance-platform (2026-09-09) declines to decide these. Tenant/path acceptance moves to the plan approval (T03).)* - ! Review the plan and obtain the decision `48a2b4ec` *(wait: Explicit human approval of the plan (status: approved, approved_by, approved_at) after the live survey.)* - ! Build the approved operator lane `0e3d1333`