build: adopt staged work-record generation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.generated-work-records.json

@@ -0,0 +1 @@
+{"version": 1, "repo_slug": "ops-warden"}

.generated-work-records.mk

@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= ops-warden
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check

Makefile

@@ -48,3 +48,10 @@ test:
 
 lint:
 	uv run ruff check .
+
+# CUST-WP-0079: explicit staged work-record generation, using the owner renderer.
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records: ## Generate and stage WORK-RECORDS from staged sources
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
+generated-work-records-check: ## Verify staged index without writes or publication
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check

SCOPE.md

@@ -534,3 +534,16 @@ keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, l
 | `history/2026-06-18-access-routing-intent-shift-assessment.md` | Routing charter decision |
 | `history/2026-06-23-flex-auth-policy-gate-production-smoke.md` | Policy gate smoke evidence |
 | `net-kingdom/docs/platform-identity-security-architecture.md` | Platform security canon |
+
+## Staged work-record generation — 2026-10-19
+
+The repository explicitly opts into the shared staged work-record generator via
+`.generated-work-records.json` and its dedicated `.generated-work-records.mk`.
+`make generated-work-records` uses the existing State Hub renderer through the
+Custodian adapter, stages only `WORK-RECORDS.md`, and refuses unreconciled
+unstaged index edits. `make generated-work-records-check` checks without writes.
+The shared commit hook retains its generated-only guard and repository-specific
+scanner routing; meaningful source commits regenerate the index before any
+configured scan.
+Generation performs no Hub calls, commits, pushes, credential access or live
+changes. Source inventories and other generated artifacts retain their owners.

WORK-RECORDS.md

@@ -32,13 +32,13 @@
 | workplan | WARDEN-WP-0031 | finished | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
 | workplan | WARDEN-WP-0032 | finished | — | workplans/WARDEN-WP-0032-security-zones.md |
 | workplan | WARDEN-WP-0033 | finished | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
-| workplan | WARDEN-WP-0034 | backlog | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| workplan | WARDEN-WP-0034 | active | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
 | workplan | WARDEN-WP-0035 | finished | — | workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md |
 | workplan | WARDEN-WP-0036 | finished | — | workplans/WARDEN-WP-0036-attended-login-openbao-output.md |
 | workplan | WARDEN-WP-0037 | blocked | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
 | workplan | WARDEN-WP-0038 | finished | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md |
 | workplan | WARDEN-WP-0039 | finished | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
-| workplan | WARDEN-WP-0040 | backlog | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| workplan | WARDEN-WP-0040 | active | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
 | workplan | WARDEN-WP-0041 | finished | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
 | workplan | WARDEN-WP-0042 | finished | — | workplans/WARDEN-WP-0042-openbao-structure-survey-route.md |
 | workplan | WARDEN-WP-0043 | finished | — | workplans/WARDEN-WP-0043-platform-supplier-credentials.md |
@@ -162,6 +162,7 @@
 | task | WARDEN-WP-0037-T01 | done | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
 | task | WARDEN-WP-0037-T02 | done | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
 | task | WARDEN-WP-0037-T03 | wait | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
+| task | WARDEN-WP-0038-T01 | done | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md |
 | task | WARDEN-WP-0039-T01 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
 | task | WARDEN-WP-0039-T02 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
 | task | WARDEN-WP-0039-T03 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |