.custodian-brief.md

@@ -2,27 +2,17 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-15 23:42 UTC  
+**Last synced:** 2026-07-12 23:52 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Credential disclosure hygiene + rotation guidance (Strand A)
+*(none — repo may need first-session setup)*
-Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
-
-**Open tasks:**
-- · Task: Capabilities-based lane verification  `9329e72d`
-- · Task: Safe access transport (no stdout values)  `3f28c573`
-- · Task: Masking display filter (defense-in-depth)  `21ab08d5`
-- · Task: Agent read-boundary on high-risk lanes  `f95d4381`
-- · Task: EXPOSED taint convention  `e989f8f0`
-- · Task: Rotation / re-establishment guidance registry  `b8a43aee`
-- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 
 ## Inbox Hygiene
 
 **Stale unread:** 11 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 10 unread message(s) lack supersession chains.
+**Missing thread_id:** 9 unread message(s) lack supersession chains.
 - ! the-custodian: ACTION: railiance01 state-hub deploy for workstream caller migration  `467153f3`
 - ! secrets-engine: Re: Need the warden-sign live apply/handoff (FLEX-WP-0007 T4)  `80456912`
 

workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md

@@ -11,7 +11,6 @@ planning_priority: high
 planning_order: 26
 created: "2026-07-16"
 updated: "2026-07-16"
-state_hub_workstream_id: "1adb34af-d5f8-42c5-89b4-44593995a281"
 ---
 
 # Credential disclosure hygiene + rotation guidance (Strand A)
@@ -63,7 +62,6 @@ advisory knowledge held next to the routing catalog, not in OpenBao.
 id: WARDEN-WP-0026-T01
 status: todo
 priority: high
-state_hub_task_id: "9329e72d-c07c-41ce-88ce-e8602eb72c43"
 ```
 
 Replace secret-reading verify flows with capability checks. Positive test:
@@ -82,7 +80,6 @@ it (see T07).
 id: WARDEN-WP-0026-T02
 status: todo
 priority: high
-state_hub_task_id: "3f28c573-8e58-4851-8aa0-925f9367f266"
 ```
 
 `warden access` / fetch paths must emit values only into an env var, a file, or
@@ -100,7 +97,6 @@ the anti-pattern is documented fleet-wide.
 id: WARDEN-WP-0026-T03
 status: todo
 priority: medium
-state_hub_task_id: "21ab08d5-7782-4567-a08d-980211dd7851"
 ```
 
 In the warden wrapper, mask KV data values by default when any listing/status is
@@ -116,7 +112,6 @@ limitation documented.
 id: WARDEN-WP-0026-T04
 status: todo
 priority: high
-state_hub_task_id: "f95d4381-f995-4c9d-b438-70b4f0ed90c5"
 ```
 
 **Repo: railiance-platform (OpenBao policy/roles).** Agent identities receive
@@ -134,7 +129,6 @@ while still allowing wrapped/proxied access, verified via capabilities checks.
 id: WARDEN-WP-0026-T05
 status: todo
 priority: medium
-state_hub_task_id: "e989f8f0-930e-4d2f-9037-221e04f34199"
 ```
 
 **Repo: railiance-platform (OpenBao) + ops-warden surface.** Establish a KV v2
@@ -152,7 +146,6 @@ a lane (advisory; no auto-rotation here).
 id: WARDEN-WP-0026-T06
 status: todo
 priority: high
-state_hub_task_id: "b8a43aee-18c7-46cd-9cfe-1f73234746d3"
 ```
 
 Give every catalog lane **structured-but-advisory** renewal guidance, held in the
@@ -172,7 +165,6 @@ every active lane, and the scorecard fails if any active lane lacks guidance.
 id: WARDEN-WP-0026-T07
 status: todo
 priority: medium
-state_hub_task_id: "9944f46d-3706-43a4-9300-7f63bf87c9ff"
 ```
 
 Write a short lessons-learned note (buildup context; exposure accepted; the three