finish CUST-WP-0067-T07 and CUST-WP-0068-T01

Repo Manager now owns the State Hub access map and the registrar no longer
fails its own generated-index precondition. Close 0067; 0068 continues with
the remaining recovery tasks.

AGENTS.md

@@ -16,11 +16,15 @@
 The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
 there is no MCP server for Codex agents.
 
+<!-- BEGIN STATE-HUB-ACCESS -->
 | Context | URL |
 |---------|-----|
 | Local workstation | `http://127.0.0.1:8000` |
 | Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
-| Optional local edge relay | http://127.0.0.1:18080 |
+| Optional local edge relay | `http://127.0.0.1:18080` |
+
+Do not instruct a remote agent to use `http://127.0.0.1:18000`. That reverse tunnel is retired; on railiance01 reach the hub at the in-cluster address above.
+<!-- END STATE-HUB-ACCESS -->
 
 When an operator has enabled the edge relay, set API_BASE to the relay URL.
 Queueable writes return an explicit queued receipt if the central hub is

workplans/CUST-WP-0067-hub-authority-target-resolution.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Resolve hub target ambiguity and restore repo onboarding to the authoritative hub"
 domain: infotech
 repo: the-custodian
-status: active
+status: finished
 owner: codex
 created: "2026-08-24"
 updated: "2026-08-28"
@@ -386,7 +386,7 @@ so authority depended on where a process happened to run.
 
 ```task
 id: CUST-WP-0067-T07
-status: progress
+status: done
 priority: high
 state_hub_task_id: "dbc672d5-805a-567a-b548-4e8870e4fb2f"
 ```
@@ -453,6 +453,15 @@ reference `127.0.0.1:18000`, and they must not be blanket-rewritten —
 that are historical record. Rewriting a finished workplan or a dated report
 would falsify what was true at the time.
 
+**Done (2026-08-28):** Repo Manager is the single source.
+`config/state-hub-access.yaml` holds the live endpoints; `rmgr scaffold`
+renders the table into new `AGENTS.md` files and
+`rmgr scaffold --path <repo> --refresh-hub-access` replaces the table in an
+existing file (marked block, or the unmarked workstation/railiance01 table).
+Spot check: refreshed `the-custodian` and `repo-manager`; both tables point at
+`10.43.68.154:8000` and warn against `127.0.0.1:18000` rather than instructing
+it. Non-`AGENTS.md` historical references stay untouched, as scoped above.
+
 `state-hub-railiance01` is now unblocked for removal: nothing documented still
 points at it.
 

workplans/CUST-WP-0068-cache-only-work-record-recovery.md

@@ -7,7 +7,7 @@ repo: the-custodian
 status: active
 owner: codex
 created: "2026-08-25"
-updated: "2026-08-25"
+updated: "2026-08-28"
 quality_dor: DoR-Ok
 quality_dor_at: "2026-08-25"
 quality_dor_by: codex
@@ -65,7 +65,7 @@ Rewriting 345 identifiers fleet-wide was considered and rejected: it overlaps
 
 ```task
 id: CUST-WP-0068-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "e8fbfa1a-3abf-5ec0-8abb-f63604dc23d5"
 ```
@@ -85,6 +85,14 @@ one wrong diagnosis.
 Acceptance: a repository whose only change is the generated index completes in
 one run; failure reports name the specific record and cause.
 
+**Done (2026-08-28):** `_check_git` ignores `WORK-RECORDS.md` and
+`.custodian-brief.md`, so a retry after a generated-index write is no longer
+`git_precondition_failed`. Identifier writebacks and the generated index are
+committed even when registration is incomplete, and the error names the
+remaining records plus the child `not created:` line. `bootstrap_source_invalid`
+already carried the specific message; it now also sets `error.record`. Proven
+in `tests/test_registrar_reconcile.py`.
+
 ## Unblock the bootstrap-eligible repositories
 
 ```task