chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-09-21:
  - update .custodian-brief.md for railiance-platform

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

.custodian-brief.md

@@ -2,11 +2,40 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-09-11 08:31 UTC  
+**Last synced:** 2026-09-21 16:45 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### ArgoCD phase B: adopt the four existing Applications on railiance01
+Progress: 0/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
+
+**Open tasks:**
+- ! Neutralise automated sync and fix the declared state  `2d7230f5`
+- ! Apply the AppProjects and the root app, automated sync off (live)  `7d97ee9c`
+- ! Adopt openbao-secretstore (lowest risk)  `6d5fc801`
+- ! Adopt issue-core (from rapp-issue-core)  `0e619658`
+- ! Adopt target-revenue  `d418068a`
+- ! Adopt external-secrets (highest risk)  `4ca54868`
+- ! Turn the root back to the production lane  `844ff115`
+- … and 1 more open tasks
+
+### Onboard rapp-policy-nexus to the ArgoCD production lane
+Progress: 0/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
+
+**Open tasks:**
+- ! Agree where policy-nexus's manifests live  `49143c5e`
+- ! Prepare the Application and the dry-run evidence  `2afb1aac`
+- ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
+- · Confirm ArgoCD actually reconciles on railiance01  `d6a7a480`
+- · Declare the platform's own direct-apply gap  `91431560`
+
+### Retract public OpenBao listener behind operator-only access
+Progress: 2/3 done  |  workplan_id: `6dda6039-295e-5cac-aef6-3183c3218649`
+
+**Open tasks:**
+- ► T03 — Complete the attended operator cutover  `8850d742`
+
 ### Close Forgejo primary backup coverage on Scaleway
 Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
 
@@ -29,14 +58,6 @@ Progress: 2/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
 - ► T03 — Collect exact owner acknowledgements  `e019c166`
 - ► T06 — Publish the Railiance/OpenBao custody handoff  `69326850`
 
-### Coordinate KeyCape live Secret exposure recovery
-Progress: 3/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
-
-**Open tasks:**
-- ! T03 — Collect exact owner acknowledgements  `714ae011`
-- ! T05 — Prove predecessor denial and close  `9cb5fa67`
-- ! T06 — Publish the Railiance/OpenBao custody handoff  `3b9748c4`
-
 ### Close S3 service assurance and ownership gaps
 Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
 
@@ -45,24 +66,13 @@ Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
 - ! Obtain acceptance for compatibility assets and derived-record cleanup  `3b74f79c`
 - ! Make backup freshness and recurring recovery evidence checkable  `d64446fb`
 
-### Retract public OpenBao listener behind operator-only access
+### Coordinate KeyCape live Secret exposure recovery
-Progress: 2/3 done  |  workplan_id: `6dda6039-295e-5cac-aef6-3183c3218649`
+Progress: 3/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
 
 **Open tasks:**
-- ! T03 — Complete the attended operator cutover  `8850d742`
+- ! T03 — Collect exact owner acknowledgements  `714ae011`
-
+- ! T05 — Prove predecessor denial and close  `9cb5fa67`
-### Coordinate audit-core temporary custody and recovery exercises
+- ! T06 — Publish the Railiance/OpenBao custody handoff  `3b9748c4`
-Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
-
-**Open tasks:**
-- ! T02 — Define the runtime database lease recovery exercise  `fda4262a`
-- ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
-
-### Remove backup credential default and verify governed replacement
-Progress: 2/3 done  |  workplan_id: `bb326ebb-a313-549e-b35f-1bf17e1c58fd`
-
-**Open tasks:**
-- ! Invalidate predecessor and prove replacement recovery  `b3f3402f`
 
 ### Implement reviewed credential lanes with separate owner gates
 Progress: 3/8 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
@@ -71,8 +81,15 @@ Progress: 3/8 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
 - ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
 - ! Implement the platform operator-write CCR contract and Fluid lane  `f47e5bc5`
 - ! Admit the separate approval client-side readers  `68bff751`
+- ! Dispose of the ungoverned whynot-design npm duplicate  `0dd7c9a5`
 - ► Admit the two factory audit-sender custody lanes  `0ef52c26`
-- · Dispose of the ungoverned whynot-design npm duplicate  `0dd7c9a5`
+
+### Coordinate audit-core temporary custody and recovery exercises
+Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
+
+**Open tasks:**
+- ! T02 — Define the runtime database lease recovery exercise  `fda4262a`
+- ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
 
 ### Retract public OpenBao listener behind operator-only access
 Progress: 2/3 done  |  workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
@@ -80,6 +97,13 @@ Progress: 2/3 done  |  workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
 **Open tasks:**
 - ! T03 — Complete the attended operator cutover  `99f8b41f`
 
+## Inbox Hygiene
+
+**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 1 unread message(s) lack supersession chains.
+- ! flex-auth: FLEX-WP-0020 handoff request (consumer)  `b55a40cb`
+- ! grok: Re: RMASTER-WP-0020-T09: S3 public OpenBao listener retracted  `d071fcd7`
+
 ---
 ## MCP Orientation (when available)