From 497040c58c5df9f3141df2aebbbf4932a685cc73 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 13:44:06 +0200 Subject: [PATCH] build: keep generated orientation brief local and untracked Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- .custodian-brief.md | 67 --------------------------------------------- .gitignore | 3 ++ SCOPE.md | 8 ++++++ 3 files changed, 11 insertions(+), 67 deletions(-) delete mode 100644 .custodian-brief.md diff --git a/.custodian-brief.md b/.custodian-brief.md deleted file mode 100644 index f595218..0000000 --- a/.custodian-brief.md +++ /dev/null @@ -1,67 +0,0 @@ - -# Custodian Brief — secrets-engine - -**Domain:** infotech -**Last synced:** 2026-10-16 19:07 UTC -**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* - -## Active Workstreams - -### Design and prove task-scoped protected OpenBao execution -Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819` - -**Open tasks:** -- ! Define the exact mediated execution contract `b2f0d462` - *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)* -- ! Implement and prove one native metadata action `5f8f7c41` - -### Constrain PDP transport and authenticate decision responses -Progress: 1/3 done | workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736` - -**Open tasks:** -- ! Verify the admitted native consumer and rotation path `85aa4c78` - *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)* -- ► Implement independently anchored responder authentication `877782e5` - -### Activate native Claude credential delivery for Glas -Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974` - -**Open tasks:** -- ! Activate the approved native lane and verify real owner delivery `f8069c8a` - *(wait: Next owner action: reconcile held parent reservation 6efa9436-6a91-47c0-94e5-b31b5a0e7e3a (EUR 10, observed USD still null) from existing provider records. No corrected runtime digest is admitted; do not retry or replay consumed approvals.)* - -### Adopt concrete OpenBao credential lanes from ops-warden -Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82` - -**Open tasks:** -- ! Stage live apply and verification `fb103f1e` - *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)* -- ! Reconcile routing ownership and retire interim proxies `1431edae` - *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)* - -### Evolve the Lifecycle engine to the accepted security layer model -Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0` - -**Open tasks:** -- ! No standing engine credential `d7bc8bdc` - *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)* - -### Production-safe provisioning, authorization, and lifecycle hardening -Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` - -**Open tasks:** -- ! Resume native production lane adoption `a0a1dd92` - *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* - -## Inbox Hygiene - -**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 2 unread message(s) lack supersession chains. - ---- -## MCP Orientation (when available) - -If the state-hub MCP server is reachable, call: -`get_domain_summary("infotech")` -This provides richer cross-domain context. -If the MCP call fails, use this file as your orientation source. diff --git a/.gitignore b/.gitignore index 66e7c65..c6349ba 100644 --- a/.gitignore +++ b/.gitignore @@ -182,3 +182,6 @@ bootstrap/ # repo-manager local index (other estate repos gitignore this too) .repo-manager/ + +# Generated workstation orientation; keep local, regenerate from State Hub. +/.custodian-brief.md diff --git a/SCOPE.md b/SCOPE.md index 944d143..3cd9d77 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -422,3 +422,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards and exact-scope secret scans remain in place. This is repository maintenance, not a runtime service, authorization decision, deployment or publication. Other index generators and hub-derived briefs retain their owner boundaries. + + +## Local orientation brief + +`.custodian-brief.md` is a generated local orientation snapshot. It remains on +disk for offline use and is root-ignored rather than versioned. Regenerate it +with the State Hub brief renderer; workplans and other authored repository +records remain authoritative. Brief refreshes must not create Git commits.