From 03eb3fbd3e71f31ebb9624fabcf5fb8b8b3c6210 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 19 Oct 2026 14:45:20 +0200
Subject: [PATCH] Document and verify installed local brief policy

---
 ...026-10-19-local-brief-cli-verification.json | 18 ++++++++++++++++++
 docs/staged-work-record-generation.md          |  9 +++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 docs/evidence/2026-10-19-local-brief-cli-verification.json

diff --git a/docs/evidence/2026-10-19-local-brief-cli-verification.json b/docs/evidence/2026-10-19-local-brief-cli-verification.json
new file mode 100644
index 0000000..eba101f
--- /dev/null
+++ b/docs/evidence/2026-10-19-local-brief-cli-verification.json
@@ -0,0 +1,18 @@
+{
+  "captured_at": "2026-10-19T12:44:51.762005+00:00",
+  "source_revision": "39b51a2",
+  "installed_checker_sha256": "59be3c28967197b9106ac3a9202deaae4b568acff7922f49c9896cb8a8eb2130",
+  "installed_matches_source": true,
+  "initial_finding": "Installed package retained old brief Git writeback despite updated checkout; first no-deps install audited without replacing copied modules.",
+  "repair": "uv pip install --python /home/worsch/state-hub/.venv/bin/python3 --no-deps --reinstall -e /home/worsch/state-hub",
+  "verification": {
+    "bindings": "90/90",
+    "automation_errors": 0,
+    "assessment_failures": 0,
+    "warnings": 6,
+    "infos": 4,
+    "brief_updated_locally": true,
+    "brief_git_warning": false
+  },
+  "scope": "local workstation CLI; no deployed service or credential change"
+}
diff --git a/docs/staged-work-record-generation.md b/docs/staged-work-record-generation.md
index 6801ea5..3ff9078 100644
--- a/docs/staged-work-record-generation.md
+++ b/docs/staged-work-record-generation.md
@@ -75,3 +75,12 @@ tracked snapshots. State Hub consistency refreshes generate them without Git
 operations. Migration preserves each local file and adds `/.custodian-brief.md`
 to `.gitignore`; `git rm --cached` removes only its tracked snapshot. Keep the
 prior local file when a fresh render fails; do not claim a fresh snapshot.
+
+Verify the installed State Hub CLI as well as its checkout when upgrading this
+policy. Its package can contain copied Python modules and scripts even after an
+editable install; a no-op package audit does not prove those bytes were replaced.
+Compare the installed `scripts/consistency_check.py` beside `custodian_cli.__file__`
+with the reviewed owner source, rebuilding the installation when they differ.
+Never force-add the ignored brief to work around a stale CLI writeback warning.
+The 2026-10-19 repair and successful follow-up sync are retained in
+`docs/evidence/2026-10-19-local-brief-cli-verification.json`.