build: adopt staged records and retain reviewed orientation snapshot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — secrets-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-10-11 17:52 UTC  
+**Last synced:** 2026-10-16 19:07 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -11,8 +11,17 @@
 Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
 
 **Open tasks:**
+- ! Define the exact mediated execution contract  `b2f0d462`
+  *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
 - ! Implement and prove one native metadata action  `5f8f7c41`
-- ► Define the exact mediated execution contract  `b2f0d462`
+
+### Constrain PDP transport and authenticate decision responses
+Progress: 1/3 done  |  workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
+
+**Open tasks:**
+- ! Verify the admitted native consumer and rotation path  `85aa4c78`
+  *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
+- ► Implement independently anchored responder authentication  `877782e5`
 
 ### Activate native Claude credential delivery for Glas
 Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
@@ -26,10 +35,17 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
 
 **Open tasks:**
 - ! Stage live apply and verification  `fb103f1e`
-  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
+  *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
 - ! Reconcile routing ownership and retire interim proxies  `1431edae`
   *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
 
+### Evolve the Lifecycle engine to the accepted security layer model
+Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+
+**Open tasks:**
+- ! No standing engine credential  `d7bc8bdc`
+  *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
+
 ### Production-safe provisioning, authorization, and lifecycle hardening
 Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
 
@@ -37,16 +53,9 @@ Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
 - ! Resume native production lane adoption  `a0a1dd92`
   *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
 
-### Evolve the Lifecycle engine to the accepted security layer model
-Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
-
-**Open tasks:**
-- ! No standing engine credential  `d7bc8bdc`
-  *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
-
 ## Inbox Hygiene
 
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
 **Missing thread_id:** 2 unread message(s) lack supersession chains.
 
 ---

.generated-work-records.json

@@ -0,0 +1 @@
+{"version":1,"repo_slug":"secrets-engine"}

.generated-work-records.mk

@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= secrets-engine
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check

Makefile

@@ -0,0 +1,8 @@
+# Repository maintenance targets
+
+# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
+generated-work-records-check:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check

SCOPE.md

@@ -405,3 +405,20 @@ description: Reports decision/readiness metadata and records scrubbed local and
   local evidence, not audit-core and not a secret-use observation API.
 keywords: [routing, evidence, state-hub, audit, secrets]
 ```
+
+
+## Repository maintenance reuse
+
+The tracked `.generated-work-records.json` adopts the Custodian staged-source
+adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing
+State Hub renderer through `.generated-work-records.mk`; the shared pre-commit
+hook runs this isolated recipe only for opted-in repositories. The corresponding
+`make generated-work-records-check` is read-only. Canonical repository identity
+is explicit and does not depend on the checkout directory.
+
+Unstaged source changes are preserved; conflicts and unstaged generated-file
+changes stop the commit. For `git commit --only`, generate first and include
+WORK-RECORDS.md with the selected source paths. Existing generated-only guards
+and exact-scope secret scans remain in place. This is repository maintenance,
+not a runtime service, authorization decision, deployment or publication.
+Other index generators and hub-derived briefs retain their owner boundaries.

WORK-RECORDS.md

@@ -22,6 +22,8 @@
 | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
 | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| workplan | SECRETS-WP-0015 | active | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
 | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
 | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
 | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@@ -83,9 +85,16 @@
 | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
 | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
 | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0015-T01 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T02 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T03 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T04 | wait | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
 | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |