chore: refresh federated capability index and generated brief

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-20 22:55 UTC  
+**Last synced:** 2026-10-20 22:59 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,7 +12,7 @@ Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
 
 **Open tasks:**
 - ! Review, publish and verify deployed consumer  `789bb918`
-  *(wait: Execution of approved credential provisioning and platform/apps image rollout)*
+  *(wait: Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao)*
 
 ---
 ## MCP Orientation (when available)

registry/indexes/federated.yaml

@@ -2060,8 +2060,10 @@ capabilities:
   source_index: ../ops-warden/registry/indexes/capabilities.yaml
 - id: capability.security.credential-lifecycle
   name: Cataloged credential lifecycle
-  summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
-    delivery and revoke.
+  summary: Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan,
+    exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file),
+    wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission
+    and a local evidence outbox.
   domain: infotech
   status: draft
   owner: secrets-engine