build: keep generated orientation brief local and untracked

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -1,67 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — secrets-engine
-
-**Domain:** infotech  
-**Last synced:** 2026-10-16 19:07 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Design and prove task-scoped protected OpenBao execution
-Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
-
-**Open tasks:**
-- ! Define the exact mediated execution contract  `b2f0d462`
-  *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
-- ! Implement and prove one native metadata action  `5f8f7c41`
-
-### Constrain PDP transport and authenticate decision responses
-Progress: 1/3 done  |  workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
-
-**Open tasks:**
-- ! Verify the admitted native consumer and rotation path  `85aa4c78`
-  *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
-- ► Implement independently anchored responder authentication  `877782e5`
-
-### Activate native Claude credential delivery for Glas
-Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
-
-**Open tasks:**
-- ! Activate the approved native lane and verify real owner delivery  `f8069c8a`
-  *(wait: Next owner action: reconcile held parent reservation 6efa9436-6a91-47c0-94e5-b31b5a0e7e3a (EUR 10, observed USD still null) from existing provider records. No corrected runtime digest is admitted; do not retry or replay consumed approvals.)*
-
-### Adopt concrete OpenBao credential lanes from ops-warden
-Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
-
-**Open tasks:**
-- ! Stage live apply and verification  `fb103f1e`
-  *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
-- ! Reconcile routing ownership and retire interim proxies  `1431edae`
-  *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
-
-### Evolve the Lifecycle engine to the accepted security layer model
-Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
-
-**Open tasks:**
-- ! No standing engine credential  `d7bc8bdc`
-  *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
-
-### Production-safe provisioning, authorization, and lifecycle hardening
-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
-
-**Open tasks:**
-- ! Resume native production lane adoption  `a0a1dd92`
-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
-
-## Inbox Hygiene
-
-**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.gitignore

@@ -182,3 +182,6 @@ bootstrap/
 
 # repo-manager local index (other estate repos gitignore this too)
 .repo-manager/
+
+# Generated workstation orientation; keep local, regenerate from State Hub.
+/.custodian-brief.md

SCOPE.md

@@ -422,3 +422,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards
 and exact-scope secret scans remain in place. This is repository maintenance,
 not a runtime service, authorization decision, deployment or publication.
 Other index generators and hub-derived briefs retain their owner boundaries.
+
+
+## Local orientation brief
+
+`.custodian-brief.md` is a generated local orientation snapshot. It remains on
+disk for offline use and is root-ignored rather than versioned. Regenerate it
+with the State Hub brief renderer; workplans and other authored repository
+records remain authoritative. Brief refreshes must not create Git commits.