# Custodian Brief — ops-warden **Domain:** infotech **Last synced:** 2026-09-14 02:59 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule Progress: 4/5 done | workplan_id: `ae3ff76f-883d-5e2f-b6aa-144d61e8fdef` **Open tasks:** - ! Tasks `7d1b3c82` ### Tamper-resistant credential governance + mass rotation/lockdown (Strand B) Progress: 2/3 done | workplan_id: `21528e8d-a049-523d-9ae1-da7a27cb8bbf` **Open tasks:** - ► Task: Graded lockdown / break-glass with explicit trust-root `cae498ee` ### Repoint the whynot-design npm lane to Forgejo Progress: 2/3 done | workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e` **Open tasks:** - ! Prove routing and publication `a8b1b855` ### Preserve explicit policy caller refusals before credential and CA effects Progress: 2/3 done | workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8` **Open tasks:** - ! Resolve the credential proxy's admitted policy binding `8ca28b63` *(wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)* ## Inbox Hygiene **Stale unread:** 7 message(s) older than 3 day(s) — triage at session start. **Missing thread_id:** 2 unread message(s) lack supersession chains. --- ## MCP Orientation (when available) If the state-hub MCP server is reachable, call: `get_domain_summary("infotech")` This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.