diff --git a/.generated-work-records.json b/.generated-work-records.json
new file mode 100644
index 0000000..3561eb6
--- /dev/null
+++ b/.generated-work-records.json
@@ -0,0 +1 @@
+{"version":1,"repo_slug":"tenant-engine"}
diff --git a/.generated-work-records.mk b/.generated-work-records.mk
new file mode 100644
index 0000000..eb9fa8b
--- /dev/null
+++ b/.generated-work-records.mk
@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= tenant-engine
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check
diff --git a/Makefile b/Makefile
index feeb6d6..d369018 100644
--- a/Makefile
+++ b/Makefile
@@ -41,3 +41,10 @@ validate-app-toml: $(VENV)/.dev-installed
 
 verify-pin:
 	@./deploy/verify-pin.sh
+
+# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
+generated-work-records-check:
+	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check
diff --git a/SCOPE.md b/SCOPE.md
index ddb5160..fe07530 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -140,3 +140,20 @@ are read rather than re-derived each session.
 - Lifecycle contract: `docs/tenant-lifecycle-api.md`
 - Agent instructions: `AGENTS.md`, `CLAUDE.md`
 - Workplans: `workplans/`
+
+
+## Repository maintenance reuse
+
+The tracked `.generated-work-records.json` adopts the Custodian staged-source
+adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing
+State Hub renderer through `.generated-work-records.mk`; the shared pre-commit
+hook runs this isolated recipe only for opted-in repositories. The corresponding
+`make generated-work-records-check` is read-only. Canonical repository identity
+is explicit and does not depend on the checkout directory.
+
+Unstaged source changes are preserved; conflicts and unstaged generated-file
+changes stop the commit. For `git commit --only`, generate first and include
+WORK-RECORDS.md with the selected source paths. Existing generated-only guards
+and exact-scope secret scans remain in place. This is repository maintenance,
+not a runtime service, authorization decision, deployment or publication.
+Other index generators and hub-derived briefs retain their owner boundaries.