build: keep generated orientation brief local and untracked

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -1,58 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — secrets-engine
-
-**Domain:** infotech  
-**Last synced:** 2026-10-11 17:52 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Design and prove task-scoped protected OpenBao execution
-Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
-
-**Open tasks:**
-- ! Implement and prove one native metadata action  `5f8f7c41`
-- ► Define the exact mediated execution contract  `b2f0d462`
-
-### Activate native Claude credential delivery for Glas
-Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
-
-**Open tasks:**
-- ! Activate the approved native lane and verify real owner delivery  `f8069c8a`
-  *(wait: Next owner action: reconcile held parent reservation 6efa9436-6a91-47c0-94e5-b31b5a0e7e3a (EUR 10, observed USD still null) from existing provider records. No corrected runtime digest is admitted; do not retry or replay consumed approvals.)*
-
-### Adopt concrete OpenBao credential lanes from ops-warden
-Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
-
-**Open tasks:**
-- ! Stage live apply and verification  `fb103f1e`
-  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
-- ! Reconcile routing ownership and retire interim proxies  `1431edae`
-  *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
-
-### Production-safe provisioning, authorization, and lifecycle hardening
-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
-
-**Open tasks:**
-- ! Resume native production lane adoption  `a0a1dd92`
-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
-
-### Evolve the Lifecycle engine to the accepted security layer model
-Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
-
-**Open tasks:**
-- ! No standing engine credential  `d7bc8bdc`
-  *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
-
-## Inbox Hygiene
-
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.generated-work-records.json

@@ -0,0 +1 @@
+{"version":1,"repo_slug":"secrets-engine"}

.generated-work-records.mk

@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= secrets-engine
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check

.gitignore

@@ -182,3 +182,6 @@ bootstrap/
 
 # repo-manager local index (other estate repos gitignore this too)
 .repo-manager/
+
+# Generated workstation orientation; keep local, regenerate from State Hub.
+/.custodian-brief.md

Makefile

@@ -0,0 +1,8 @@
+# Repository maintenance targets
+
+# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
+generated-work-records-check:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check

SCOPE.md

@@ -405,3 +405,28 @@ description: Reports decision/readiness metadata and records scrubbed local and
   local evidence, not audit-core and not a secret-use observation API.
 keywords: [routing, evidence, state-hub, audit, secrets]
 ```
+
+
+## Repository maintenance reuse
+
+The tracked `.generated-work-records.json` adopts the Custodian staged-source
+adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing
+State Hub renderer through `.generated-work-records.mk`; the shared pre-commit
+hook runs this isolated recipe only for opted-in repositories. The corresponding
+`make generated-work-records-check` is read-only. Canonical repository identity
+is explicit and does not depend on the checkout directory.
+
+Unstaged source changes are preserved; conflicts and unstaged generated-file
+changes stop the commit. For `git commit --only`, generate first and include
+WORK-RECORDS.md with the selected source paths. Existing generated-only guards
+and exact-scope secret scans remain in place. This is repository maintenance,
+not a runtime service, authorization decision, deployment or publication.
+Other index generators and hub-derived briefs retain their owner boundaries.
+
+
+## Local orientation brief
+
+`.custodian-brief.md` is a generated local orientation snapshot. It remains on
+disk for offline use and is root-ignored rather than versioned. Regenerate it
+with the State Hub brief renderer; workplans and other authored repository
+records remain authoritative. Brief refreshes must not create Git commits.

WORK-RECORDS.md

@@ -22,6 +22,8 @@
 | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
 | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| workplan | SECRETS-WP-0015 | active | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
 | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
 | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
 | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@@ -83,9 +85,16 @@
 | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
 | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
 | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0015-T01 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T02 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T03 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
+| task | SECRETS-WP-0015-T04 | wait | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
 | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |