.custodian-brief.md

@@ -2,29 +2,22 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-16 12:26 UTC  
+**Last synced:** 2026-07-15 23:42 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Credential disclosure hygiene + rotation guidance (Strand A)
-Progress: 1/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
+Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
 
 **Open tasks:**
-- ► Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
+- · Task: Capabilities-based lane verification  `9329e72d`
 - · Task: Safe access transport (no stdout values)  `3f28c573`
 - · Task: Masking display filter (defense-in-depth)  `21ab08d5`
 - · Task: Agent read-boundary on high-risk lanes  `f95d4381`
 - · Task: EXPOSED taint convention  `e989f8f0`
 - · Task: Rotation / re-establishment guidance registry  `b8a43aee`
-
-### Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
-Progress: 0/3 done  |  workplan_id: `7d697c52-766a-4562-b2ad-a722880bcdcb`
-
-**Open tasks:**
-- ! Task: Executable mass rotation driver  `604aad14`
-- ! Task: Graded lockdown / break-glass with explicit trust-root  `9d004d8f`
-- ! Task: Tamper-evident policy governance + reconcile  `94d5dcaf`
+- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 
 ## Inbox Hygiene
 

workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Credential disclosure hygiene + rotation guidance (Strand A)"
 domain: infotech
 repo: ops-warden
-status: active
+status: ready
 owner: codex
 topic_slug: custodian
 planning_priority: high

workplans/WARDEN-WP-0027-credential-governance-lockdown.md

@@ -4,14 +4,13 @@ type: workplan
 title: "Tamper-resistant credential governance + mass rotation/lockdown (Strand B)"
 domain: infotech
 repo: ops-warden
-status: active
+status: backlog
 owner: codex
 topic_slug: custodian
 planning_priority: medium
 planning_order: 27
 created: "2026-07-16"
 updated: "2026-07-16"
-state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
 ---
 
 # Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
@@ -62,7 +61,6 @@ path; ops-warden sequences and verifies it.
 id: WARDEN-WP-0027-T01
 status: wait
 priority: high
-state_hub_task_id: "604aad14-d398-4c02-85e5-7ff37a905a1b"
 ```
 
 Turn Strand A's per-lane `rotation:` guidance (WP-0026 T06) into an executable
@@ -83,7 +81,6 @@ each verified capabilities-safe, taint cleared only on success.
 id: WARDEN-WP-0027-T02
 status: wait
 priority: medium
-state_hub_task_id: "9d004d8f-6215-4178-bd13-5785d24fd152"
 ```
 
 Design and document a graded lockdown: (a) soft — deny agent roles read on all
@@ -102,7 +99,6 @@ policy toggles.
 id: WARDEN-WP-0027-T03
 status: wait
 priority: medium
-state_hub_task_id: "94d5dcaf-abf0-417c-a6ef-26e8c50905a8"
 ```
 
 Policy-as-code for OpenBao policies/roles with tamper-evidence: a signed/hashed