ops-warden/.custodian-brief.md

Custodian Brief — ops-warden

Domain: infotech
Last synced: 2026-09-21 00:18 UTC
State Hub: http://127.0.0.1:8000 (adjust if running on a remote machine)

Active Workstreams

Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule

Progress: 4/6 done | workplan_id: ae3ff76f-883d-5e2f-b6aa-144d61e8fdef

Open tasks:

• ! Tasks 7d1b3c82
• ! Await gate-house's §11 precedence and case-sensitivity ruling b3b573df

Tamper-resistant credential governance + mass rotation/lockdown (Strand B)

Progress: 2/3 done | workplan_id: 21528e8d-a049-523d-9ae1-da7a27cb8bbf

Open tasks:

• ► Task: Graded lockdown / break-glass with explicit trust-root cae498ee

Repoint the whynot-design npm lane to Forgejo

Progress: 2/3 done | workplan_id: 42a097db-1c24-558e-a724-030bb2b4443e

Open tasks:

• ! Prove routing and publication a8b1b855

Preserve explicit policy caller refusals before credential and CA effects

Progress: 2/3 done | workplan_id: ae44a935-6fca-514c-a385-4550dd2b1fe8

Open tasks:

• ! Resolve the credential proxy's admitted policy binding 8ca28b63 (wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)

Inbox Hygiene

Stale unread: 8 message(s) older than 3 day(s) — triage at session start. Missing thread_id: 3 unread message(s) lack supersession chains.

• ! flex-auth: FLEX-WP-0020 handoff request (credential-route) 0a1956c5

---

MCP Orientation (when available)

If the state-hub MCP server is reachable, call: get_domain_summary("infotech") This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.