docs: preserve reviewed NetKingdom session artifacts

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r2/publication-commit.json

@@ -0,0 +1,165 @@
+{
+  "exit_code": 1,
+  "commit": "bab3dd1c9df67f344fb207904a8edb3896bf4bd1",
+  "base": "bab3dd1c9df67f344fb207904a8edb3896bf4bd1",
+  "files": [
+    {
+      "path": ".kaizen/agents/custodian-codex/supervision.json",
+      "sha256": "6da87d32ad01919507beaf32248586fa2996337034ec9e39ad96bf3b975ac6bf"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md",
+      "sha256": "865e22f76f3c5a66dfd5ee5b39e735ef99c7e40429515f465bd1b9fabe74ed1e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/check_upstream_release.py",
+      "sha256": "bf4e0bfe5f233d988df566fafb56c869bb809123204068460acc3d7ec0668f40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/checker-reproduction.json",
+      "sha256": "196d654fb711ff9e4fbd4e89a3a79fe61f77a74208942e9c6c8be5d417699e40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml",
+      "sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client.yaml",
+      "sha256": "52e21883f677e69c99813eca8f273cea06e598c0475e5d51959251ba05161f53"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request.json",
+      "sha256": "c56938c703a04a6b5c7a274c48d29e762042f6e3c2be318f605d96ba54705419"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/delivery-metadata.json",
+      "sha256": "883d25d0c42904b6e1c450572252664677c23bdc7e50076551db74e1be242940"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json",
+      "sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json",
+      "sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-auth-source-inventory.json",
+      "sha256": "84c005ebf6cab6d04108b05b899f941479f4cc4b98719447cebfc2d341fdd0a1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml",
+      "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/helm-render-validation.json",
+      "sha256": "0b458d9f3f4184323c890c063db7e52f715af56084b9df0512050cb466a7941c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/issuer-start-probe.json",
+      "sha256": "d6599ea6bba54295937a1a6371768c8464139f00b3265cc5367f891c6b78d4d1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/native-signin-settings.json",
+      "sha256": "92f4be74ea1a2b05822896018b3e40ec17be379c7b27d44f7d077b937891eb0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml",
+      "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation.json",
+      "sha256": "a85a9256bf87a7f321fd7b05ef461c7f4eb28a698a5a0d25cad705bb53d3940e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.json",
+      "sha256": "61eff8b488674e75510133fe118de86d895be04c033e109c3597c03ed2ecf30e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.sha256",
+      "sha256": "49ad6b5e7bccc88ffe3630454facb3ea49a6663cb42ad423b548d2adc4d52754"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.json",
+      "sha256": "3966e5e9f3db2160cd0ec05e1c32a3f40c80e3448b1147c0bb80d9831748492f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.jsonl",
+      "sha256": "c36143e6ca9285b1f596df3c0e1873b767b2cfda70c2620cd63b43333e909ce2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.json",
+      "sha256": "9e341cd83f74d64d538b0481109c477796a477a268688abc53c096f332d708e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.jsonl",
+      "sha256": "491ebcaf534083308c9bb5ca4df3c3f0e3e52ee98f1c5c614b88aaa8ffe82172"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.json",
+      "sha256": "663cafc1ebf62d3a46c47476e24d989f1077454919e032af5a6995164d89aef5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.jsonl",
+      "sha256": "4713adec78a038964aff5c2b2c30b7ea9adda7582e9aee9edfbef97863bae5b2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-baseline.json",
+      "sha256": "c29bd2100de02383507a06340ab5a71ded1743f121d84bb4848f72bfb3a06330"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-result.json",
+      "sha256": "0fe021cacb6c8db0727ca8e4f31fa29960549fba3dd11871de00453667f40b0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-build-values.yaml",
+      "sha256": "5239c5c635d2467d7b3f4ea90e85ac71819afcca6b07f609c56b7d22b36ca1b6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-dry-run.json",
+      "sha256": "4dc8aaab56534b10a7c58e32fe5f20d379645cbdd2005278a2eedfb9b1fab6b3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-inspection.json",
+      "sha256": "6dba568b9ffa3cc8dc38b773344d1848ed00112c171352deb55d0897fd6299ca"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public_pkce_interop_test.go",
+      "sha256": "8968c617d83bb041f0c2a4c251bf1efc88db45036f51c6eb55c5058bdb662aed"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/railiance-apps.patch",
+      "sha256": "65f1702d3450512f1b022992f0ec31953ae1e748e70d6e7d69fc2ddd64267312"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/rebuild_checker.py",
+      "sha256": "385a2590ecd63a59aa0189b0fc9501d2b727a4edf991c560343beff5fb106a2d"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/registration-inspection.json",
+      "sha256": "793f65acfc8e4f59224bc29dc48eec0fdef2b587cd16dedc4d3d06a3301ef098"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/run_public_protocol.py",
+      "sha256": "5d9ad425ebfafa317088ec8c2ed571d0398a3b131b0314af8658f345114b3d88"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/upstream-release-result.json",
+      "sha256": "e4da5c8f605a871004be87fcd4e38b7bfaf9f3ca00922b8d1485e1226101e823"
+    },
+    {
+      "path": "docs/security-close-down-checklist.md",
+      "sha256": "5163f275b0a614de60086aa4593b6a093751ed1a1d8353a18fec545f41454d9b"
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "4d65cdf6daa7855fed37277cdb63ce42ac59c35adee90dc0d89437ae835cb105"
+    },
+    {
+      "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md",
+      "sha256": "481b13f6c5c7ef3a2120ddedcfbcdeaeb8f5543a4737c08afdec097b2b5ec3d2"
+    }
+  ],
+  "stdout": "",
+  "stderr": "{\"blocked_blob_ids\": [\"18b3b902241a1b52b807ef52d2bdb0f1d41fc8b4\"], \"scanned_blobs\": 39, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"blocked\"}\n"
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r2/publication-inputs.json

@@ -0,0 +1,163 @@
+{
+  "owner": "the-custodian",
+  "base_revision": "bab3dd1c9df67f344fb207904a8edb3896bf4bd1",
+  "message": "Prepare and verify the Forgejo public-PKCE build profile for scoped review",
+  "files": [
+    {
+      "path": ".kaizen/agents/custodian-codex/supervision.json",
+      "sha256": "6da87d32ad01919507beaf32248586fa2996337034ec9e39ad96bf3b975ac6bf"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md",
+      "sha256": "865e22f76f3c5a66dfd5ee5b39e735ef99c7e40429515f465bd1b9fabe74ed1e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/check_upstream_release.py",
+      "sha256": "bf4e0bfe5f233d988df566fafb56c869bb809123204068460acc3d7ec0668f40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/checker-reproduction.json",
+      "sha256": "196d654fb711ff9e4fbd4e89a3a79fe61f77a74208942e9c6c8be5d417699e40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml",
+      "sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client.yaml",
+      "sha256": "52e21883f677e69c99813eca8f273cea06e598c0475e5d51959251ba05161f53"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request.json",
+      "sha256": "c56938c703a04a6b5c7a274c48d29e762042f6e3c2be318f605d96ba54705419"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/delivery-metadata.json",
+      "sha256": "883d25d0c42904b6e1c450572252664677c23bdc7e50076551db74e1be242940"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json",
+      "sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json",
+      "sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-auth-source-inventory.json",
+      "sha256": "84c005ebf6cab6d04108b05b899f941479f4cc4b98719447cebfc2d341fdd0a1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml",
+      "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/helm-render-validation.json",
+      "sha256": "0b458d9f3f4184323c890c063db7e52f715af56084b9df0512050cb466a7941c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/issuer-start-probe.json",
+      "sha256": "d6599ea6bba54295937a1a6371768c8464139f00b3265cc5367f891c6b78d4d1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/native-signin-settings.json",
+      "sha256": "92f4be74ea1a2b05822896018b3e40ec17be379c7b27d44f7d077b937891eb0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml",
+      "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation.json",
+      "sha256": "a85a9256bf87a7f321fd7b05ef461c7f4eb28a698a5a0d25cad705bb53d3940e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.json",
+      "sha256": "61eff8b488674e75510133fe118de86d895be04c033e109c3597c03ed2ecf30e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.sha256",
+      "sha256": "49ad6b5e7bccc88ffe3630454facb3ea49a6663cb42ad423b548d2adc4d52754"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.json",
+      "sha256": "3966e5e9f3db2160cd0ec05e1c32a3f40c80e3448b1147c0bb80d9831748492f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.jsonl",
+      "sha256": "c36143e6ca9285b1f596df3c0e1873b767b2cfda70c2620cd63b43333e909ce2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.json",
+      "sha256": "9e341cd83f74d64d538b0481109c477796a477a268688abc53c096f332d708e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.jsonl",
+      "sha256": "491ebcaf534083308c9bb5ca4df3c3f0e3e52ee98f1c5c614b88aaa8ffe82172"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.json",
+      "sha256": "663cafc1ebf62d3a46c47476e24d989f1077454919e032af5a6995164d89aef5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.jsonl",
+      "sha256": "4713adec78a038964aff5c2b2c30b7ea9adda7582e9aee9edfbef97863bae5b2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-baseline.json",
+      "sha256": "c29bd2100de02383507a06340ab5a71ded1743f121d84bb4848f72bfb3a06330"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-result.json",
+      "sha256": "0fe021cacb6c8db0727ca8e4f31fa29960549fba3dd11871de00453667f40b0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-build-values.yaml",
+      "sha256": "5239c5c635d2467d7b3f4ea90e85ac71819afcca6b07f609c56b7d22b36ca1b6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-dry-run.json",
+      "sha256": "4dc8aaab56534b10a7c58e32fe5f20d379645cbdd2005278a2eedfb9b1fab6b3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-inspection.json",
+      "sha256": "6dba568b9ffa3cc8dc38b773344d1848ed00112c171352deb55d0897fd6299ca"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public_pkce_interop_test.go",
+      "sha256": "8968c617d83bb041f0c2a4c251bf1efc88db45036f51c6eb55c5058bdb662aed"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/railiance-apps.patch",
+      "sha256": "65f1702d3450512f1b022992f0ec31953ae1e748e70d6e7d69fc2ddd64267312"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/rebuild_checker.py",
+      "sha256": "385a2590ecd63a59aa0189b0fc9501d2b727a4edf991c560343beff5fb106a2d"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/registration-inspection.json",
+      "sha256": "793f65acfc8e4f59224bc29dc48eec0fdef2b587cd16dedc4d3d06a3301ef098"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/run_public_protocol.py",
+      "sha256": "5d9ad425ebfafa317088ec8c2ed571d0398a3b131b0314af8658f345114b3d88"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/upstream-release-result.json",
+      "sha256": "e4da5c8f605a871004be87fcd4e38b7bfaf9f3ca00922b8d1485e1226101e823"
+    },
+    {
+      "path": "docs/security-close-down-checklist.md",
+      "sha256": "5163f275b0a614de60086aa4593b6a093751ed1a1d8353a18fec545f41454d9b"
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "4d65cdf6daa7855fed37277cdb63ce42ac59c35adee90dc0d89437ae835cb105"
+    },
+    {
+      "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md",
+      "sha256": "481b13f6c5c7ef3a2120ddedcfbcdeaeb8f5543a4737c08afdec097b2b5ec3d2"
+    }
+  ]
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/consistency.json

@@ -0,0 +1,208 @@
+{
+  "repo_slug": "the-custodian",
+  "repo_path": "/home/worsch/the-custodian",
+  "source_revision": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
+      "file_path": "workplans/",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
+      "file_path": "workplans/ADHOC-2026-08-25-retired.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-33",
+      "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
+      "file_path": "WORK-RECORDS.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-05",
+      "message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)",
+      "file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md",
+      "db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e",
+      "file_value": "Domain and Repository Goals",
+      "db_value": "Workplan Lifecycle Documentation",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
+      "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
+      "db_id": "",
+      "file_value": "STATE-WP-0092",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-40",
+      "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
+      "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
+      "db_id": "",
+      "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-39",
+      "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
+      "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
+      "db_id": "",
+      "file_value": "needs_human: true",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-10",
+      "message": "Task status drift 'CUST-WP-0080-T41': file='done' db='progress' (file wins)",
+      "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T41",
+      "db_id": "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8",
+      "file_value": "done",
+      "db_value": "progress",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-22",
+      "message": "Task description drift 'CUST-WP-0080-T41': file content differs from DB (file wins)",
+      "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T41",
+      "db_id": "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8",
+      "file_value": "Prepared: [exact public-PKCE build-profile proposal](../docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-prep",
+      "db_value": "Implementation owners: Apps RAPPS-WP-0016-T02; KeyCape KEY-WP-0038-T02; existing NetKingdom registration/delivery path. ",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-39",
+      "message": "Human wait task 'CUST-WP-0080-T42' in workplan 'CUST-WP-0080' has needs_human: true without decision_id \u2014 unrouted human gate",
+      "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T42",
+      "db_id": "",
+      "file_value": "needs_human: true",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-10",
+      "message": "Task status drift 'CUST-WP-0080-T42': file='wait' db='todo' (file wins)",
+      "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T42",
+      "db_id": "bd135b74-05db-5f51-ac89-d1967fdcf36b",
+      "file_value": "wait",
+      "db_value": "todo",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-41",
+      "message": "Task wait-qualifier drift 'CUST-WP-0080-T42': file={'needs_human': True, 'blocking_reason': None, 'decision_id': None, 'blocked_on': None, 'wait_until': None} db={'needs_human': False, 'blocking_reason': None, 'decision_id': None, 'blocked_on': None, 'wait_until': None} (file wins)",
+      "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T42",
+      "db_id": "bd135b74-05db-5f51-ac89-d1967fdcf36b",
+      "file_value": "{\"blocked_on\": null, \"blocking_reason\": null, \"decision_id\": null, \"needs_human\": true, \"wait_until\": null}",
+      "db_value": "{\"blocked_on\": null, \"blocking_reason\": null, \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-22",
+      "message": "Task description drift 'CUST-WP-0082-T20': file content differs from DB (file wins)",
+      "file_path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md#CUST-WP-0082-T20",
+      "db_id": "eef7e3d9-9cfb-5525-af82-a8cc1bba6e67",
+      "file_value": "Remaining security acceptance from CUST-WP-0080-T19, CUST-WP-0080-T23. The build-mode functional receipts do not close t",
+      "db_value": "Remaining security acceptance from CUST-WP-0080-T19, CUST-WP-0080-T23. The build-mode functional receipts do not close t",
+      "fixable": true
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
+      "file_path": "",
+      "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "370c2481-6806-41eb-a917-f8874f03184f",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
+      "file_path": "workplans/THE-WP-0001-federation-interface.md",
+      "db_id": "",
+      "file_value": "THE-WP-0001",
+      "db_value": "CUST-WP",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 90/90",
+    "C-17 cleared: pushed 1 backlogged commit(s)",
+    "C-33 fixed: regenerated WORK-RECORDS.md",
+    "C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'",
+    "C-10 fixed: task d6f1da6c\u2026 status \u2192 'done'",
+    "C-22 fixed: task d6f1da6c\u2026 description updated",
+    "C-10 FAILED: task bd135b74\u2026 status \u2192 'wait': Client error '422 Unprocessable Entity' for url 'http://127.0.0.1:8000/tasks/bd135b74-05db-5f51-ac89-d1967fdcf36b'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/422",
+    "C-41 fixed: task bd135b74\u2026 wait qualifiers synced",
+    "C-22 fixed: task eef7e3d9\u2026 description updated",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 14,
+    "info": 4
+  },
+  "result": "warn"
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/consistency.stderr.txt

@@ -0,0 +1,2 @@
+WARN: git commit failed for writeback: Generated-only commits rejected: staged
+WARN: working-memory commit failed: Generated-only commits rejected: staged

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/final-readback.json

@@ -0,0 +1,377 @@
+{
+  "verified": true,
+  "published_revision": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+  "primary_projection_exact": true,
+  "source_task_bindings": [
+    {
+      "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+      "verified_tasks": 44,
+      "rows": [
+        {
+          "id": "CUST-WP-0080-T01",
+          "hub_task_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T02",
+          "hub_task_id": "5973026f-8ca9-5882-99fe-65a54bc250ac",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T03",
+          "hub_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3",
+          "status": "progress"
+        },
+        {
+          "id": "CUST-WP-0080-T04",
+          "hub_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0080-T05",
+          "hub_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T06",
+          "hub_task_id": "6aca534c-5c7a-556f-b6b6-406433670c29",
+          "status": "progress"
+        },
+        {
+          "id": "CUST-WP-0080-T07",
+          "hub_task_id": "bb236dea-30f7-5437-b01c-f14d2509e061",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T08",
+          "hub_task_id": "18b885fe-503f-5ebc-b390-808f71316264",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T09",
+          "hub_task_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T10",
+          "hub_task_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T11",
+          "hub_task_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T12",
+          "hub_task_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T13",
+          "hub_task_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T14",
+          "hub_task_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T15",
+          "hub_task_id": "434d9c78-7789-5b78-8d9d-d87b0638b469",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T16",
+          "hub_task_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T17",
+          "hub_task_id": "4de46468-7ae2-59e3-be2b-1a32506153a5",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T18",
+          "hub_task_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T19",
+          "hub_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T20",
+          "hub_task_id": "0d9df435-b9a2-5b89-833d-799785c969a9",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T21",
+          "hub_task_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T22",
+          "hub_task_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T23",
+          "hub_task_id": "266e228b-7754-5323-b0c6-37f860592d90",
+          "status": "progress"
+        },
+        {
+          "id": "CUST-WP-0080-T24",
+          "hub_task_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T25",
+          "hub_task_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T26",
+          "hub_task_id": "0491b6b4-a238-58ef-bf3a-505749e5655c",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T27",
+          "hub_task_id": "19540d29-c4df-5f1a-acf7-127965c9a396",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T28",
+          "hub_task_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T29",
+          "hub_task_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T30",
+          "hub_task_id": "457400ad-6c44-5160-a77a-63c6ad5acabc",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T31",
+          "hub_task_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T32",
+          "hub_task_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T33",
+          "hub_task_id": "4547ac4c-8893-54fe-ae6e-362682bb7920",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0080-T34",
+          "hub_task_id": "393b9fcc-323b-5182-92c6-44530fce7efb",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T35",
+          "hub_task_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T36",
+          "hub_task_id": "586232a1-57b0-5e04-a61b-fb687bcc8999",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T37",
+          "hub_task_id": "d533ca34-a691-5f8e-8cc2-5f408b679538",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0080-T38",
+          "hub_task_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T39",
+          "hub_task_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T40",
+          "hub_task_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e",
+          "status": "cancel"
+        },
+        {
+          "id": "CUST-WP-0080-T41",
+          "hub_task_id": "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8",
+          "status": "done"
+        },
+        {
+          "id": "CUST-WP-0080-T42",
+          "hub_task_id": "bd135b74-05db-5f51-ac89-d1967fdcf36b",
+          "status": "wait"
+        },
+        {
+          "id": "CUST-WP-0080-T43",
+          "hub_task_id": "f869f913-2349-5223-8c3e-5c76f4cebe60",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0080-T44",
+          "hub_task_id": "8c9c4dda-5047-5d37-9037-4f7e5eac53d8",
+          "status": "todo"
+        }
+      ]
+    },
+    {
+      "workplan_id": "b29f9f25-b508-5c2c-98fd-2f6877f109cf",
+      "verified_tasks": 25,
+      "rows": [
+        {
+          "id": "CUST-WP-0082-T01",
+          "hub_task_id": "2ac61e1a-5a01-5ff9-ae35-017efe1e987c",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T02",
+          "hub_task_id": "a88d7bbe-49d8-5dc0-a613-eeebb756bd0c",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T03",
+          "hub_task_id": "55e99c7e-69de-523a-88f1-660c3f69edb0",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T04",
+          "hub_task_id": "aa7112b1-e76e-520e-a59a-6aa4aa39b35d",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T05",
+          "hub_task_id": "8e9c5b9a-8315-5efa-9cd3-00a113c6ea81",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T06",
+          "hub_task_id": "a7cf387e-da06-5cca-8815-43a4ecbf8ea9",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T07",
+          "hub_task_id": "c555c76a-00e8-5d07-9aef-7a4e6ac7ea11",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T08",
+          "hub_task_id": "f1dbdb5d-30cb-5012-9fa5-e59520ba2aae",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T09",
+          "hub_task_id": "88c0467d-b8b8-5972-b50a-2a87b51365fb",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T10",
+          "hub_task_id": "5ddfe024-b823-51c9-ac4d-ec5e53c47346",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T11",
+          "hub_task_id": "5b3767a0-5657-5ae3-b094-70e429a26617",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T12",
+          "hub_task_id": "cbac0912-ac45-58d4-93db-8f49ac7750b2",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T13",
+          "hub_task_id": "1903466c-674f-5025-acd7-873396c6d2fe",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T14",
+          "hub_task_id": "38363478-e46b-54bd-972d-ce998f3b8dd0",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T15",
+          "hub_task_id": "564a545a-b43d-5013-8f1b-e34cd54b52c7",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T16",
+          "hub_task_id": "90c8fb36-9032-57e7-85da-684d18e5c0b1",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T17",
+          "hub_task_id": "9e35af30-ec53-58f4-8517-5a5df85b6c79",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T18",
+          "hub_task_id": "316d9fc2-27e3-53ce-809d-a50769fa9734",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T19",
+          "hub_task_id": "9e26f419-0547-596a-bd0c-66b39f2d6ba8",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T20",
+          "hub_task_id": "eef7e3d9-9cfb-5525-af82-a8cc1bba6e67",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T21",
+          "hub_task_id": "d3dd8c35-284b-5035-a1a3-e0a0dbef86ba",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T22",
+          "hub_task_id": "43a94f1e-e906-55ac-a837-d9ce5c495d6b",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T23",
+          "hub_task_id": "4fda91f5-94c1-52fc-9dbd-c3693950165b",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T24",
+          "hub_task_id": "2c92d61d-61ed-5813-a2e0-6e055c6cb564",
+          "status": "todo"
+        },
+        {
+          "id": "CUST-WP-0082-T25",
+          "hub_task_id": "18cc3a93-f3ac-561c-84ce-8f009130c951",
+          "status": "todo"
+        }
+      ]
+    }
+  ],
+  "unrelated_worktree_and_index_preserved": 8,
+  "consistency_summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 14,
+    "info": 4
+  },
+  "proposal_revision": 2,
+  "proposal_digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3",
+  "founder_decision": "ad88edeb-7c7c-486f-a695-1a7abae5b20c",
+  "needs_human_prompt_verified": true,
+  "native_changes_executed": false,
+  "goal_complete": false
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/progress-close.json

@@ -0,0 +1,14 @@
+{
+  "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+  "id": "ebdfd024-852d-4562-a105-d7f141862e2f",
+  "topic_id": null,
+  "task_id": "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8",
+  "decision_id": null,
+  "event_type": "note",
+  "summary": "WP80 T41 complete preparation: inspected actual missing forgejo registration/env/delivery and empty Forgejo source inventory; proved actual issuer + upstream Goth public PKCE/token/UserInfo, wrong-verifier/replay refusal with synthetic MFA/session; unchanged Forgejo11.0.3 runtime passed disposable CLI/page/PKCE redirect; local login preserved. Reproduced owner-reviewed be37738f checker; actual live/proposed registry checks and server dry-run pass with no mutation. Prepared exact temporary public-PKCE build-profile proposal CUST80-FORGEJO-PUBLIC-BUILD-20261018 r2 sha fcea2cd3, source postimages, four commands, two restarts and created-only rollback; confidential-client/full security target remains CUST-WP-0082-T20. r1 publication refusal was two actual public source hashes misclassified as keys; r2 uses typed path/hash records and passes unchanged ordinary controls. Original digest/bytes/reconstruction and refusal receipts retained; same trial, no go or scored native success fabricated. Normal publication17635cb0 and exact primary readback verify44WP80+25WP82 tasks, no consistency failures/automation errors and all8 unrelated index/worktree states preserved. T42 waits on actual founder decision ad88edeb and authorization of independent NetKingdom/Apps/KeyCape reviewers; exact UI question submitted. No new agents, native changes, credentials or authority promotion.",
+  "detail": null,
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-18T17:33:24.998857Z",
+  "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/projection.json

@@ -0,0 +1,304 @@
+{
+  "ok": true,
+  "status": "applied",
+  "repo_slug": "the-custodian",
+  "commit": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+  "requests": 2,
+  "elapsed_ms": 11290.3,
+  "git": {
+    "upstream": "origin/main",
+    "behind": 0,
+    "ahead": 0
+  },
+  "identifiers": {
+    "schema": "repo-manager.identifier-assignment.v1",
+    "ok": true,
+    "executed": true,
+    "repo": "the-custodian",
+    "namespace": "helixforge",
+    "assignments": [],
+    "historical_invalid_identifiers": [
+      {
+        "kind": "workplan",
+        "id": "CUST-WP-ADHOC-2026-08-25-RETIRED",
+        "source": "workplans/ADHOC-2026-08-25-retired.md"
+      }
+    ],
+    "historical_identity_collisions": [],
+    "files_changed": []
+  },
+  "receipt": {
+    "schema": "state-hub.repository-projection-reconcile.v1",
+    "instance_role": "primary",
+    "instance_label": "railiance01",
+    "expected_commit": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+    "derived_commit": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+    "outcome": {
+      "schema": "state-hub.projection-reset.v1",
+      "repo_slug": "the-custodian",
+      "commit": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+      "status": "applied",
+      "counts": {
+        "created": 0,
+        "updated": 89,
+        "retired": 0,
+        "refused": 0,
+        "released": 0,
+        "created_tasks": 0,
+        "updated_tasks": 1,
+        "cancelled_tasks": 0,
+        "created_edges": 0,
+        "removed_edges": 1,
+        "unresolved_edges": 0,
+        "external_edges": 13
+      },
+      "created": [],
+      "updated": [
+        "CUST-WP-0000",
+        "CUST-WP-0000b",
+        "CUST-WP-0000c",
+        "CUST-WP-0001",
+        "CUST-WP-0002",
+        "CUST-WP-0004",
+        "CUST-WP-0005",
+        "CUST-WP-0006",
+        "CUST-WP-0007",
+        "CUST-WP-0008",
+        "CUST-WP-0009",
+        "CUST-WP-0010",
+        "CUST-WP-0010b",
+        "CUST-WP-0013",
+        "CUST-WP-0014",
+        "CUST-WP-0015",
+        "CUST-WP-0016",
+        "CUST-WP-0017",
+        "CUST-WP-0017-LEGACY",
+        "CUST-WP-0018",
+        "CUST-WP-0019",
+        "CUST-WP-0020",
+        "CUST-WP-0021",
+        "CUST-WP-0022",
+        "CUST-WP-0023",
+        "CUST-WP-0024",
+        "CUST-WP-0025",
+        "CUST-WP-0026",
+        "CUST-WP-0027",
+        "CUST-WP-0028",
+        "CUST-WP-0029",
+        "CUST-WP-0030",
+        "CUST-WP-0031",
+        "CUST-WP-0032",
+        "CUST-WP-0033",
+        "CUST-WP-0034",
+        "CUST-WP-0035",
+        "CUST-WP-0036",
+        "CUST-WP-0037",
+        "CUST-WP-0039",
+        "CUST-WP-0040",
+        "CUST-WP-0041",
+        "CUST-WP-0043",
+        "CUST-WP-0044",
+        "CUST-WP-0045",
+        "CUST-WP-0046",
+        "CUST-WP-0047",
+        "CUST-WP-0048",
+        "CUST-WP-0049",
+        "CUST-WP-0050",
+        "CUST-WP-0051",
+        "CUST-WP-0052",
+        "CUST-WP-0053",
+        "CUST-WP-0053-LEGACY",
+        "CUST-WP-0054",
+        "CUST-WP-0055",
+        "CUST-WP-0056",
+        "CUST-WP-0057",
+        "CUST-WP-0058",
+        "CUST-WP-0059",
+        "CUST-WP-0060",
+        "CUST-WP-0061",
+        "CUST-WP-0062",
+        "CUST-WP-0063",
+        "CUST-WP-0064",
+        "CUST-WP-0065",
+        "CUST-WP-0066",
+        "CUST-WP-0067",
+        "CUST-WP-0068",
+        "CUST-WP-0069",
+        "CUST-WP-0070",
+        "CUST-WP-0071",
+        "CUST-WP-0072",
+        "CUST-WP-0073",
+        "CUST-WP-0074",
+        "CUST-WP-0075",
+        "CUST-WP-0076",
+        "CUST-WP-0077",
+        "CUST-WP-0078",
+        "CUST-WP-0079",
+        "CUST-WP-0080",
+        "CUST-WP-0081",
+        "CUST-WP-0082",
+        "CUST-WP-ADHOC-2026-03-29",
+        "CUST-WP-ADHOC-2026-05-02",
+        "CUST-WP-ADHOC-2026-07-02",
+        "CUST-WP-ADHOC-2026-08-25",
+        "CUST-WP-ADHOC-2026-09-06",
+        "THE-WP-0001"
+      ],
+      "retired": [],
+      "released": [],
+      "created_tasks": [],
+      "updated_tasks": [
+        "CUST-WP-0080-T42"
+      ],
+      "cancelled_tasks": [],
+      "created_edges": [],
+      "removed_edges": [
+        {
+          "id": "1d16cacb-9845-4709-9fbe-78efc42f391c",
+          "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+          "from_task_id": "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8",
+          "to_workplan_id": null,
+          "to_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8",
+          "relationship_type": "starts_after"
+        }
+      ],
+      "unresolved_edges": [],
+      "external_edges": [
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T05",
+          "target": "CUST-WP-0071-T04",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca",
+          "to_workplan_id": null,
+          "to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc"
+        },
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T03",
+          "target": "CUST-WP-0071-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
+          "to_workplan_id": null,
+          "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
+        },
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T03",
+          "target": "CUST-WP-0071-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
+          "to_workplan_id": null,
+          "to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68"
+        },
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T02",
+          "target": "CUST-WP-0071-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
+          "to_workplan_id": null,
+          "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
+        },
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T02",
+          "target": "RAPPS-WP-0014-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
+          "to_workplan_id": null,
+          "to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1"
+        },
+        {
+          "workplan": "CUST-WP-0071",
+          "from": "CUST-WP-0071-T04",
+          "target": "CUST-WP-0071-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
+          "from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc",
+          "to_workplan_id": null,
+          "to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495"
+        },
+        {
+          "workplan": "CUST-WP-0073",
+          "from": "CUST-WP-0073-T02",
+          "target": "GLAS-WP-0012",
+          "relationship_type": "blocks",
+          "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
+          "from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35",
+          "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
+          "to_task_id": null
+        },
+        {
+          "workplan": "CUST-WP-0073",
+          "from": "CUST-WP-0073-T04",
+          "target": "CUST-WP-0073-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
+          "from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4",
+          "to_workplan_id": null,
+          "to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35"
+        },
+        {
+          "workplan": "CUST-WP-0079",
+          "from": "CUST-WP-0079-T03",
+          "target": "ACTIVITY-WP-0047",
+          "relationship_type": "blocks",
+          "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
+          "from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1",
+          "to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3",
+          "to_task_id": null
+        },
+        {
+          "workplan": "CUST-WP-0079",
+          "from": "CUST-WP-0079-T04",
+          "target": "PNEX-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
+          "from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6",
+          "to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a",
+          "to_task_id": null
+        },
+        {
+          "workplan": "CUST-WP-0080",
+          "from": "CUST-WP-0080-T23",
+          "target": "CUST-WP-0080-T19",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+          "from_task_id": "266e228b-7754-5323-b0c6-37f860592d90",
+          "to_workplan_id": null,
+          "to_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8"
+        },
+        {
+          "workplan": "CUST-WP-0080",
+          "from": "CUST-WP-0080-T33",
+          "target": "CUST-WP-0080-T12",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+          "from_task_id": "4547ac4c-8893-54fe-ae6e-362682bb7920",
+          "to_workplan_id": null,
+          "to_task_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda"
+        },
+        {
+          "workplan": "CUST-WP-0080",
+          "from": "CUST-WP-0080-T04",
+          "target": "CUST-WP-0080-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+          "from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
+          "to_workplan_id": null,
+          "to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3"
+        }
+      ],
+      "refused": [],
+      "notes": [
+        "Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED"
+      ]
+    }
+  }
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,62 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — the-custodian
+
+**Domain:** infotech  
+**Last synced:** 2026-10-15 23:45 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### NetKingdom target security architecture and SEC-DSM implementation
+Progress: 2/6 done  |  workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52`
+
+**Open tasks:**
+- ► Close source defects and reconcile uncovered lifecycle gaps  `87637402`
+- ► Coordinate self-service Playwright identity delivery  `ed8b909a`
+- ► Establish the target architecture and drive the restructuring  `6aca534c`
+- · Verify native closure against every requirement  `82378b0f`
+
+### Separate agent credentials and establish supervised privileged execution
+Progress: 2/5 done  |  workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
+
+**Open tasks:**
+- ! Build and hand out the agent identity  `4b88b0b7`
+  *(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-enablement k3s config, railiance-infra principal mapping and ops-warden certificate issuance.)*
+- ! Fleet guidance and harness guards  `90725511`
+  *(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)*
+- ! Rotate what was exposed  `1b41b532`
+  *(wait: Deferred by founder decision 2026-09-24; reopened only by the founder on one of the three triggers below, in one attended rotation window.)*
+
+### Size Railiance workloads from actual demand and establish a weekly allocation review
+Progress: 1/5 done  |  workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3`
+
+**Open tasks:**
+- ! Measure the Vergabe prototype under representative pilot use  `82192370`
+  *(wait: Await RAPPS-WP-0014-T03 (blocked, needs_human): populated two-user/document workflow run by Bernd and the company contact, giving representative load for p95 <= 2s / zero failures.)*
+- ! Review ecosystem allocations and reserve operating room  `6dc67558`
+  *(wait: Await CUST-WP-0071-T02 representative sample; Forgejo/runner demand and zero-request workload review need owner input (railiance-cluster, railiance-forge, resource-control).)*
+- ! Apply accepted sizing changes and verify their effects  `944f98e2`
+  *(wait: Await reviewed allocation proposals and applicable workload-owner authority.)*
+- ! Establish the regular weekly workload-demand and allocation assessment  `20ddd4d7`
+  *(wait: Await the repeatable observation and accepted sizing/review procedure.)*
+
+### Deterministic security flow: standing authorizations, flow report, and agent re-engagement
+Progress: 3/7 done  |  workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3`
+
+**Open tasks:**
+- ! Schedule the flow report and decision sync  `1be0569c`
+  *(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)*
+- ! Encode the standing change rule as a policy-nexus guardrail  `5dd52156`
+  *(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)*
+- ! Stop agent-authored index and sync commits  `8a3dc219`
+  *(wait: Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed.)*
+- ! Attended window #1  `e3da807f`
+  *(wait: Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login.)*
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,536 @@
+# Work Records — the-custodian
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | CUST-WP-ADHOC-2026-05-02 | done | — | workplans/ADHOC-2026-05-02.md |
+| workplan | CUST-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | CUST-WP-ADHOC-2026-08-25-RETIRED | finished | — | workplans/ADHOC-2026-08-25-retired.md |
+| workplan | CUST-WP-ADHOC-2026-08-25 | finished | — | workplans/ADHOC-2026-08-25.md |
+| workplan | CUST-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md |
+| workplan | CUST-WP-0000 | finished | — | workplans/CUST-WP-0000-state-hub-v0.1-build-deploy.md |
+| workplan | CUST-WP-0000b | finished | — | workplans/CUST-WP-0000b-state-hub-v0.2-decisions-dependencies.md |
+| workplan | CUST-WP-0001 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
+| workplan | CUST-WP-0002 | finished | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| workplan | CUST-WP-0004 | finished | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| workplan | CUST-WP-0005 | finished | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| workplan | CUST-WP-0006 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| workplan | CUST-WP-0007 | finished | — | workplans/CUST-WP-0007-gems-migration.md |
+| workplan | CUST-WP-0008 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
+| workplan | CUST-WP-0009 | finished | — | workplans/CUST-WP-0009-human-interventions.md |
+| workplan | CUST-WP-0010 | finished | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
+| workplan | CUST-WP-0010b | finished | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
+| workplan | CUST-WP-0013 | finished | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| workplan | CUST-WP-0015 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| workplan | CUST-WP-0016 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| workplan | CUST-WP-0017 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| workplan | CUST-WP-0018 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| workplan | CUST-WP-0019 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
+| workplan | CUST-WP-0020 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| workplan | CUST-WP-0021 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| workplan | CUST-WP-0022 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| workplan | CUST-WP-0023 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| workplan | CUST-WP-0024 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| workplan | CUST-WP-0026 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| workplan | CUST-WP-0027 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| workplan | CUST-WP-0029 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| workplan | CUST-WP-0030 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| workplan | CUST-WP-0031 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| workplan | CUST-WP-0032 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| workplan | CUST-WP-0033 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| workplan | CUST-WP-0039 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| workplan | CUST-WP-0040 | finished | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| workplan | CUST-WP-0041 | done | — | workplans/CUST-WP-0041-api-performance.md |
+| workplan | CUST-WP-0043 | finished | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| workplan | CUST-WP-0044 | finished | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| workplan | CUST-WP-0045 | finished | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| workplan | CUST-WP-0069 | finished | — | workplans/CUST-WP-0045-cutover-runbook.md |
+| workplan | CUST-WP-0046 | finished | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| workplan | CUST-WP-0047 | finished | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| workplan | CUST-WP-0048 | finished | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| workplan | CUST-WP-0049 | finished | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| workplan | CUST-WP-0050 | finished | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| workplan | CUST-WP-0051 | finished | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| workplan | CUST-WP-0052 | finished | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| workplan | CUST-WP-0053 | finished | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| workplan | CUST-WP-0055 | finished | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| workplan | CUST-WP-0056 | finished | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
+| workplan | CUST-WP-0059 | finished | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| workplan | CUST-WP-0060 | finished | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| workplan | CUST-WP-0061 | finished | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| workplan | CUST-WP-0062 | finished | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| workplan | CUST-WP-0063 | finished | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| workplan | CUST-WP-0064 | finished | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| workplan | CUST-WP-0065 | finished | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
+| workplan | CUST-WP-0066 | finished | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
+| workplan | CUST-WP-0067 | finished | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| workplan | CUST-WP-0068 | finished | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| workplan | CUST-WP-0070 | finished | — | workplans/CUST-WP-0070-publication-repo-category.md |
+| workplan | CUST-WP-0071 | blocked | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| workplan | CUST-WP-0072 | finished | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
+| workplan | CUST-WP-0073 | blocked | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| workplan | CUST-WP-0074 | finished | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| workplan | CUST-WP-0075 | finished | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| workplan | CUST-WP-0076 | finished | — | workplans/CUST-WP-0076-provisioning-window-cadence.md |
+| workplan | CUST-WP-0077 | finished | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| workplan | CUST-WP-0078 | finished | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
+| workplan | CUST-WP-0079 | blocked | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| workplan | CUST-WP-0080 | active | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| workplan | CUST-WP-0081 | finished | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
+| workplan | THE-WP-0001 | finished | — | workplans/THE-WP-0001-federation-interface.md |
+| task | CUST-WP-ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md |
+| task | CUST-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25-retired.md |
+| task | CUST-WP-ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25.md |
+| task | CUST-WP-ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md |
+| task | CUST-WP-0001-T01 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
+| task | CUST-WP-0001-T02 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
+| task | CUST-WP-0002-T01 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T02 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T03 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T04 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T05 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T06 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T07 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T08 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T09 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T10 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T11 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T12 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T13 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T14 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0002-T15 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md |
+| task | CUST-WP-0004-T01 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T02 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T03 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T04 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T05 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T06 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T07 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T08 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T09 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0004-T10 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md |
+| task | CUST-WP-0005-T01 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T02 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T03 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T04 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T05 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T06 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T07 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T08 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T09 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T10 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | CUST-WP-0005-T11 | done | — | workplans/CUST-WP-0005-dynamic-domains.md |
+| task | T01 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| task | T02 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| task | T03 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| task | T04 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| task | T05 | done | — | workplans/CUST-WP-0006-gems-state-hub.md |
+| task | T01 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T02 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T03 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T04 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T05 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T06 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T07 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T08 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T09 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T10 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T11 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T12 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T13 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T14 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T15 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T16 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | T17 | done | — | workplans/CUST-WP-0007-gems-migration.md |
+| task | CUST-WP-0008-T01 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
+| task | CUST-WP-0008-T02 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
+| task | CUST-WP-0008-T03 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
+| task | CUST-WP-0008-T04 | done | — | workplans/CUST-WP-0008-consistency-engine.md |
+| task | CUST-WP-0009-T1 | done | — | workplans/CUST-WP-0009-human-interventions.md |
+| task | CUST-WP-0009-T2 | done | — | workplans/CUST-WP-0009-human-interventions.md |
+| task | CUST-WP-0009-T3 | done | — | workplans/CUST-WP-0009-human-interventions.md |
+| task | CUST-WP-0010-T1 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
+| task | CUST-WP-0010-T2 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
+| task | CUST-WP-0010-T3 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md |
+| task | CUST-WP-0010b-T01 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
+| task | CUST-WP-0010b-T02 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md |
+| task | CUST-WP-0013-T01 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T02 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T03 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T04 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T05 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T06 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T07 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T08 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T09 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T10 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T11 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T12 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T13 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0013-T14 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md |
+| task | CUST-WP-0015-T01 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| task | CUST-WP-0015-T02 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| task | CUST-WP-0015-T03 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| task | CUST-WP-0015-T04 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| task | CUST-WP-0015-T05 | done | — | workplans/CUST-WP-0015-agent-inbox.md |
+| task | CUST-WP-0016-T01 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| task | CUST-WP-0016-T02 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| task | CUST-WP-0016-T03 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| task | CUST-WP-0016-T04 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| task | CUST-WP-0016-T05 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md |
+| task | CUST-WP-0017-T01 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0017-T02 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0017-T03 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0017-T04 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0017-T05 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0017-T06 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md |
+| task | CUST-WP-0018-T01 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T02 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T03 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T04 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T05 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T06 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0018-T07 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md |
+| task | CUST-WP-0019-T01 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
+| task | CUST-WP-0019-T02 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
+| task | CUST-WP-0019-T03 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md |
+| task | CUST-WP-0020-T01 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| task | CUST-WP-0020-T02 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| task | CUST-WP-0020-T03 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| task | CUST-WP-0020-T04 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| task | CUST-WP-0020-T05 | done | — | workplans/CUST-WP-0020-test-suite.md |
+| task | CUST-WP-0021-T01 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| task | CUST-WP-0021-T02 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| task | CUST-WP-0021-T03 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| task | CUST-WP-0021-T04 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| task | CUST-WP-0021-T05 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md |
+| task | CUST-WP-0022-T01 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T02 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T03 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T04 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T05 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T06 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T07 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T08 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T09 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0022-T10 | done | — | workplans/CUST-WP-0022-capability-requests.md |
+| task | CUST-WP-0023-T01 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T02 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T03 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T04 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T05 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T06 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T07 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T08 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T09 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0023-T10 | done | — | workplans/CUST-WP-0023-tpsc.md |
+| task | CUST-WP-0024-T01 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| task | CUST-WP-0024-T02 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| task | CUST-WP-0024-T03 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| task | CUST-WP-0024-T04 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| task | CUST-WP-0024-T05 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md |
+| task | CUST-WP-0026-T01 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| task | CUST-WP-0026-T02 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| task | CUST-WP-0026-T03 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| task | CUST-WP-0026-T04 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| task | CUST-WP-0026-T05 | done | — | workplans/CUST-WP-0026-distributed-consistency.md |
+| task | CUST-WP-0027-T01 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| task | CUST-WP-0027-T02 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| task | CUST-WP-0027-T03 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| task | CUST-WP-0027-T04 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| task | CUST-WP-0027-T05 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md |
+| task | CUST-WP-0029-T01 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T02 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T03 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T04 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T05 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T06 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T07 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | CUST-WP-0029-T08 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md |
+| task | T01 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T02 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T03 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T04 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T05 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T06 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T07 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T08 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T09 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md |
+| task | T01 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T02 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T03 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T04 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T05 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T06 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | T07 | done | — | workplans/CUST-WP-0031-capability-registry.md |
+| task | CUST-WP-0032-T01 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T02 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T03 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T04 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T05 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T06 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T07 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T08 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T09 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T10 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T11 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T12 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T13 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T14 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0032-T15 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md |
+| task | CUST-WP-0033-T01 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0033-T02 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0033-T03 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0033-T04 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0033-T05 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0033-T06 | done | — | workplans/CUST-WP-0033-interface-change-registry.md |
+| task | CUST-WP-0039-T1 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | CUST-WP-0039-T2 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | CUST-WP-0039-T3 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | CUST-WP-0039-T4 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | CUST-WP-0039-T5 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | CUST-WP-0039-T6 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md |
+| task | T01 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | T02 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | T03 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | T04 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | T05 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | T06 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md |
+| task | CUST-WP-0041-T1 | done | — | workplans/CUST-WP-0041-api-performance.md |
+| task | CUST-WP-0041-T2 | done | — | workplans/CUST-WP-0041-api-performance.md |
+| task | CUST-WP-0041-T3 | done | — | workplans/CUST-WP-0041-api-performance.md |
+| task | CUST-WP-0041-T4 | done | — | workplans/CUST-WP-0041-api-performance.md |
+| task | CUST-WP-0043-T01 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T02 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T03 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T04 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T05 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T06 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T07 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T08 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0043-T09 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md |
+| task | CUST-WP-0044-T01 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0044-T02 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0044-T03 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0044-T04 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0044-T05 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0044-T06 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md |
+| task | CUST-WP-0045-T01 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T02 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T03 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T04 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T05 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T06 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T07 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0045-T08 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md |
+| task | CUST-WP-0046-T01 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T02 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T03 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T04 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T05 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T06 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0046-T07 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md |
+| task | CUST-WP-0047-T01 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T02 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T03 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T04 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T05 | cancel | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T06 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0047-T07 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md |
+| task | CUST-WP-0048-T01 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T02 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T03 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T04 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T05 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T06 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T07 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0048-T08 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md |
+| task | CUST-WP-0049-T01 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0049-T02 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0049-T03 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0049-T04 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0049-T05 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0049-T06 | cancel | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md |
+| task | CUST-WP-0050-T01 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T02 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T03 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T04 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T05 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T06 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T07 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T08 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T09 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T10 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0050-T11 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md |
+| task | CUST-WP-0051-T01 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T02 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T03 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T04 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T05 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T06 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T07 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0051-T08 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md |
+| task | CUST-WP-0052-T01 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T02 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T03 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T04 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T05 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T06 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0052-T07 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md |
+| task | CUST-WP-0053-T01 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| task | CUST-WP-0053-T02 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| task | CUST-WP-0053-T03 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| task | CUST-WP-0053-T04 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| task | CUST-WP-0053-T05 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md |
+| task | CUST-WP-0055-T01 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T02 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T03 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T04 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T05 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T06 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T07 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0055-T08 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md |
+| task | CUST-WP-0056-T01 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
+| task | CUST-WP-0056-T02 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
+| task | CUST-WP-0056-T03 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md |
+| task | CUST-WP-0059-T01 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0059-T02 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0059-T03 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0059-T04 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0059-T05 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0059-T06 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md |
+| task | CUST-WP-0060-T01 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T02 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T03 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T04 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T05 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T06 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0060-T07 | done | — | workplans/CUST-WP-0060-work-record-canonization.md |
+| task | CUST-WP-0061-T01 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0061-T02 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0061-T03 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0061-T04 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0061-T05 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0061-T06 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
+| task | CUST-WP-0062-T01 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0062-T02 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0062-T03 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0062-T04 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0062-T05 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0062-T06 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
+| task | CUST-WP-0063-T01 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| task | CUST-WP-0063-T02 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| task | CUST-WP-0063-T03 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
+| task | CUST-WP-0064-T01 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| task | CUST-WP-0064-T02 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| task | CUST-WP-0064-T03 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| task | CUST-WP-0064-T04 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| task | CUST-WP-0065-T01 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
+| task | CUST-WP-0065-T02 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
+| task | CUST-WP-0065-T03 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
+| task | CUST-WP-0065-T04 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md |
+| task | CUST-WP-0066-T01 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
+| task | CUST-WP-0066-T02 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
+| task | CUST-WP-0066-T03 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md |
+| task | CUST-WP-0067-T01 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T02 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T03 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T04 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T05 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T06 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T07 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T08 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T09 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0067-T10 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md |
+| task | CUST-WP-0068-T01 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T02 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T03 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T04 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T05 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T06 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T07 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T08 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0068-T09 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md |
+| task | CUST-WP-0070-T01 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
+| task | CUST-WP-0070-T02 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
+| task | CUST-WP-0070-T03 | done | — | workplans/CUST-WP-0070-publication-repo-category.md |
+| task | CUST-WP-0071-T01 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0071-T02 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0071-T03 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0071-T04 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0071-T05 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0072-T01 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
+| task | CUST-WP-0072-T02 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
+| task | CUST-WP-0072-T03 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
+| task | CUST-WP-0072-T04 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
+| task | CUST-WP-0073-T01 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| task | CUST-WP-0073-T02 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| task | CUST-WP-0073-T03 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| task | CUST-WP-0073-T04 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| task | CUST-WP-0073-T05 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md |
+| task | CUST-WP-0074-T01 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0074-T02 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0074-T03 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0074-T04 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0074-T05 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0074-T06 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md |
+| task | CUST-WP-0075-T01 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0075-T02 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0075-T03 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0075-T04 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0075-T05 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0075-T06 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md |
+| task | CUST-WP-0076-T01 | done | — | workplans/CUST-WP-0076-provisioning-window-cadence.md |
+| task | CUST-WP-0077-T01 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| task | CUST-WP-0077-T02 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| task | CUST-WP-0077-T03 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| task | CUST-WP-0077-T04 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| task | CUST-WP-0077-T05 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md |
+| task | CUST-WP-0078-T01 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
+| task | CUST-WP-0078-T02 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
+| task | CUST-WP-0078-T03 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
+| task | CUST-WP-0078-T04 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
+| task | CUST-WP-0079-T01 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T05 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
+| task | CUST-WP-0080-T01 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0080-T02 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0080-T03 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0080-T04 | todo | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0080-T05 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0080-T06 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md |
+| task | CUST-WP-0081-T01 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
+| task | CUST-WP-0081-T02 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
+| task | CUST-WP-0081-T03 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md |
+| task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md |
+| task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md |
+| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0004 | routed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0005 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0006 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0007 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0008 | closed | blue | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0009 | closed | blue | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0010 | closed | green | intake-legacy-suggestions-migration.md |
+| intake | CUST-IN-0011 | routed | red | intakes.md |
+| intake | CUST-IN-0012 | closed | green | intakes.md |
+| intake | CUST-IN-0013 | closed | blue | intakes.md |
+| intake | CUST-IN-0014 | closed | blue | intakes.md |
+| intake | CUST-IN-0015 | open | blue | intakes.md |
+| intake | CUST-IN-0016 | open | green | intakes.md |
+| intake | CUST-IN-0017 | open | green | intakes.md |
+| intake | CUST-IN-0018 | open | green | intakes.md |

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 6aad3a5788fad3abd60c0f1270f160062dc0168b 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 d535e0f2dcc3d454e041a8f1b547b5dea4493380 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/publication-commit.json

@@ -0,0 +1,177 @@
+{
+  "exit_code": 0,
+  "commit": "17635cb0a76e5595ec06421ab7419ae889f6d731",
+  "base": "bab3dd1c9df67f344fb207904a8edb3896bf4bd1",
+  "files": [
+    {
+      "path": ".kaizen/agents/custodian-codex/supervision.json",
+      "sha256": "ed8cbb79bb8958960c2b8b7b3155be7919ed0973f20dc3ace95ad3fffab04e70"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md",
+      "sha256": "df1c7c579db58115721062ed741c6679fa218802ce241be841badac335595ac3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/check_upstream_release.py",
+      "sha256": "bf4e0bfe5f233d988df566fafb56c869bb809123204068460acc3d7ec0668f40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/checker-reproduction.json",
+      "sha256": "196d654fb711ff9e4fbd4e89a3a79fe61f77a74208942e9c6c8be5d417699e40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml",
+      "sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client.yaml",
+      "sha256": "52e21883f677e69c99813eca8f273cea06e598c0475e5d51959251ba05161f53"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request-r2.json",
+      "sha256": "984191cdf4e545ad27b8620f578194e7cb3ffbeeca19de63151bb633124fc4fa"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request.json",
+      "sha256": "c56938c703a04a6b5c7a274c48d29e762042f6e3c2be318f605d96ba54705419"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/delivery-metadata.json",
+      "sha256": "883d25d0c42904b6e1c450572252664677c23bdc7e50076551db74e1be242940"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json",
+      "sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json",
+      "sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-auth-source-inventory.json",
+      "sha256": "84c005ebf6cab6d04108b05b899f941479f4cc4b98719447cebfc2d341fdd0a1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml",
+      "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/helm-render-validation.json",
+      "sha256": "0b458d9f3f4184323c890c063db7e52f715af56084b9df0512050cb466a7941c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/issuer-start-probe.json",
+      "sha256": "d6599ea6bba54295937a1a6371768c8464139f00b3265cc5367f891c6b78d4d1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/native-signin-settings.json",
+      "sha256": "92f4be74ea1a2b05822896018b3e40ec17be379c7b27d44f7d077b937891eb0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml",
+      "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation-r1.json",
+      "sha256": "a85a9256bf87a7f321fd7b05ef461c7f4eb28a698a5a0d25cad705bb53d3940e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation.json",
+      "sha256": "17e3a43121d9884f9c66cb1f303bb8784481d1db0eceb638a68ebcf401d5a655"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.json",
+      "sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.sha256",
+      "sha256": "f781a423ff9cd188eb9afa4c1cdb340d4d98d78708bf26e6d63e273152f0f4e8"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.json",
+      "sha256": "3966e5e9f3db2160cd0ec05e1c32a3f40c80e3448b1147c0bb80d9831748492f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.jsonl",
+      "sha256": "c36143e6ca9285b1f596df3c0e1873b767b2cfda70c2620cd63b43333e909ce2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.json",
+      "sha256": "9e341cd83f74d64d538b0481109c477796a477a268688abc53c096f332d708e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.jsonl",
+      "sha256": "491ebcaf534083308c9bb5ca4df3c3f0e3e52ee98f1c5c614b88aaa8ffe82172"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.json",
+      "sha256": "663cafc1ebf62d3a46c47476e24d989f1077454919e032af5a6995164d89aef5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.jsonl",
+      "sha256": "4713adec78a038964aff5c2b2c30b7ea9adda7582e9aee9edfbef97863bae5b2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-baseline.json",
+      "sha256": "c29bd2100de02383507a06340ab5a71ded1743f121d84bb4848f72bfb3a06330"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-result.json",
+      "sha256": "0fe021cacb6c8db0727ca8e4f31fa29960549fba3dd11871de00453667f40b0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-build-values.yaml",
+      "sha256": "5239c5c635d2467d7b3f4ea90e85ac71819afcca6b07f609c56b7d22b36ca1b6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-dry-run.json",
+      "sha256": "4dc8aaab56534b10a7c58e32fe5f20d379645cbdd2005278a2eedfb9b1fab6b3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-inspection.json",
+      "sha256": "6dba568b9ffa3cc8dc38b773344d1848ed00112c171352deb55d0897fd6299ca"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public_pkce_interop_test.go",
+      "sha256": "8968c617d83bb041f0c2a4c251bf1efc88db45036f51c6eb55c5058bdb662aed"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/railiance-apps.patch",
+      "sha256": "65f1702d3450512f1b022992f0ec31953ae1e748e70d6e7d69fc2ddd64267312"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/rebuild_checker.py",
+      "sha256": "385a2590ecd63a59aa0189b0fc9501d2b727a4edf991c560343beff5fb106a2d"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/registration-inspection.json",
+      "sha256": "793f65acfc8e4f59224bc29dc48eec0fdef2b587cd16dedc4d3d06a3301ef098"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/revision-history.json",
+      "sha256": "9c354cd8d7e0345a0fb8e26b3a4be4d41db04f0a1f3930e7198f070948fffff4"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/run_public_protocol.py",
+      "sha256": "5d9ad425ebfafa317088ec8c2ed571d0398a3b131b0314af8658f345114b3d88"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/upstream-release-result.json",
+      "sha256": "e4da5c8f605a871004be87fcd4e38b7bfaf9f3ca00922b8d1485e1226101e823"
+    },
+    {
+      "path": "docs/security-close-down-checklist.md",
+      "sha256": "6a919377302dd00733b46692730c92dc41525b881a5a017a505c6659bc06909a"
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "994678a5981cc653d3a334cffed36b9b9df1cf21c65761d394f9e5601b53b695"
+    },
+    {
+      "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md",
+      "sha256": "481b13f6c5c7ef3a2120ddedcfbcdeaeb8f5543a4737c08afdec097b2b5ec3d2"
+    }
+  ],
+  "stdout": "[main 17635cb] Prepare verified Forgejo public-PKCE build profile revision 2 for scoped review\n 42 files changed, 1632 insertions(+), 5 deletions(-)\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/check_upstream_release.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/checker-reproduction.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request-r2.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/delivery-metadata.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-auth-source-inventory.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/helm-render-validation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/issuer-start-probe.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/native-signin-settings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation-r1.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.sha256\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.jsonl\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.jsonl\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.jsonl\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-baseline.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-build-values.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-inspection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public_pkce_interop_test.go\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/railiance-apps.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/rebuild_checker.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/registration-inspection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/revision-history.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/run_public_protocol.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/upstream-release-result.json\n",
+  "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 42, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/retry-r3/publication-inputs.json

@@ -0,0 +1,175 @@
+{
+  "owner": "the-custodian",
+  "base_revision": "bab3dd1c9df67f344fb207904a8edb3896bf4bd1",
+  "message": "Prepare verified Forgejo public-PKCE build profile revision 2 for scoped review",
+  "files": [
+    {
+      "path": ".kaizen/agents/custodian-codex/supervision.json",
+      "sha256": "ed8cbb79bb8958960c2b8b7b3155be7919ed0973f20dc3ace95ad3fffab04e70"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md",
+      "sha256": "df1c7c579db58115721062ed741c6679fa218802ce241be841badac335595ac3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/check_upstream_release.py",
+      "sha256": "bf4e0bfe5f233d988df566fafb56c869bb809123204068460acc3d7ec0668f40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/checker-reproduction.json",
+      "sha256": "196d654fb711ff9e4fbd4e89a3a79fe61f77a74208942e9c6c8be5d417699e40"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml",
+      "sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client.yaml",
+      "sha256": "52e21883f677e69c99813eca8f273cea06e598c0475e5d51959251ba05161f53"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request-r2.json",
+      "sha256": "984191cdf4e545ad27b8620f578194e7cb3ffbeeca19de63151bb633124fc4fa"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/decision-request.json",
+      "sha256": "c56938c703a04a6b5c7a274c48d29e762042f6e3c2be318f605d96ba54705419"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/delivery-metadata.json",
+      "sha256": "883d25d0c42904b6e1c450572252664677c23bdc7e50076551db74e1be242940"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json",
+      "sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json",
+      "sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-auth-source-inventory.json",
+      "sha256": "84c005ebf6cab6d04108b05b899f941479f4cc4b98719447cebfc2d341fdd0a1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml",
+      "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/helm-render-validation.json",
+      "sha256": "0b458d9f3f4184323c890c063db7e52f715af56084b9df0512050cb466a7941c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/issuer-start-probe.json",
+      "sha256": "d6599ea6bba54295937a1a6371768c8464139f00b3265cc5367f891c6b78d4d1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/native-signin-settings.json",
+      "sha256": "92f4be74ea1a2b05822896018b3e40ec17be379c7b27d44f7d077b937891eb0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml",
+      "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation-r1.json",
+      "sha256": "a85a9256bf87a7f321fd7b05ef461c7f4eb28a698a5a0d25cad705bb53d3940e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/prepublication-validation.json",
+      "sha256": "17e3a43121d9884f9c66cb1f303bb8784481d1db0eceb638a68ebcf401d5a655"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.json",
+      "sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/proposal.sha256",
+      "sha256": "f781a423ff9cd188eb9afa4c1cdb340d4d98d78708bf26e6d63e273152f0f4e8"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.json",
+      "sha256": "3966e5e9f3db2160cd0ec05e1c32a3f40c80e3448b1147c0bb80d9831748492f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt1.jsonl",
+      "sha256": "c36143e6ca9285b1f596df3c0e1873b767b2cfda70c2620cd63b43333e909ce2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.json",
+      "sha256": "9e341cd83f74d64d538b0481109c477796a477a268688abc53c096f332d708e1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt2.jsonl",
+      "sha256": "491ebcaf534083308c9bb5ca4df3c3f0e3e52ee98f1c5c614b88aaa8ffe82172"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.json",
+      "sha256": "663cafc1ebf62d3a46c47476e24d989f1077454919e032af5a6995164d89aef5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-attempt3.jsonl",
+      "sha256": "4713adec78a038964aff5c2b2c30b7ea9adda7582e9aee9edfbef97863bae5b2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-baseline.json",
+      "sha256": "c29bd2100de02383507a06340ab5a71ded1743f121d84bb4848f72bfb3a06330"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/protocol-result.json",
+      "sha256": "0fe021cacb6c8db0727ca8e4f31fa29960549fba3dd11871de00453667f40b0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-build-values.yaml",
+      "sha256": "5239c5c635d2467d7b3f4ea90e85ac71819afcca6b07f609c56b7d22b36ca1b6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-dry-run.json",
+      "sha256": "4dc8aaab56534b10a7c58e32fe5f20d379645cbdd2005278a2eedfb9b1fab6b3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public-registration-inspection.json",
+      "sha256": "6dba568b9ffa3cc8dc38b773344d1848ed00112c171352deb55d0897fd6299ca"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/public_pkce_interop_test.go",
+      "sha256": "8968c617d83bb041f0c2a4c251bf1efc88db45036f51c6eb55c5058bdb662aed"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/railiance-apps.patch",
+      "sha256": "65f1702d3450512f1b022992f0ec31953ae1e748e70d6e7d69fc2ddd64267312"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/rebuild_checker.py",
+      "sha256": "385a2590ecd63a59aa0189b0fc9501d2b727a4edf991c560343beff5fb106a2d"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/registration-inspection.json",
+      "sha256": "793f65acfc8e4f59224bc29dc48eec0fdef2b587cd16dedc4d3d06a3301ef098"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/revision-history.json",
+      "sha256": "9c354cd8d7e0345a0fb8e26b3a4be4d41db04f0a1f3930e7198f070948fffff4"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/run_public_protocol.py",
+      "sha256": "5d9ad425ebfafa317088ec8c2ed571d0398a3b131b0314af8658f345114b3d88"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/upstream-release-result.json",
+      "sha256": "e4da5c8f605a871004be87fcd4e38b7bfaf9f3ca00922b8d1485e1226101e823"
+    },
+    {
+      "path": "docs/security-close-down-checklist.md",
+      "sha256": "6a919377302dd00733b46692730c92dc41525b881a5a017a505c6659bc06909a"
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "994678a5981cc653d3a334cffed36b9b9df1cf21c65761d394f9e5601b53b695"
+    },
+    {
+      "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md",
+      "sha256": "481b13f6c5c7ef3a2120ddedcfbcdeaeb8f5543a4737c08afdec097b2b5ec3d2"
+    }
+  ]
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/scanner-diagnosis-r1.json

@@ -0,0 +1,23 @@
+{
+  "scan_exit_code": 20,
+  "findings": [
+    {
+      "RuleID": "generic-api-key",
+      "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
+      "StartLine": 51,
+      "EndLine": 51,
+      "StartColumn": 52,
+      "EndColumn": 137
+    },
+    {
+      "RuleID": "generic-api-key",
+      "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
+      "StartLine": 55,
+      "EndLine": 55,
+      "StartColumn": 48,
+      "EndColumn": 123
+    }
+  ],
+  "raw_match_and_secret_discarded": true,
+  "native_secret_access": false
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/publication/scanner-r2-clean.json

@@ -0,0 +1,7 @@
+{
+  "exit_code": 0,
+  "same_pinned_default_scanner": true,
+  "no_rule_or_exemption_change": true,
+  "change": "Public source pins represented as typed path/sha256 records; identical full hashes retained",
+  "proposal_sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3"
+}

docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/owner-integration/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,47 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — railiance-apps
+
+**Domain:** financials  
+**Last synced:** 2026-10-17 10:13 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Forgejo sign-in through NetKingdom, before the forge closes
+Progress: 1/5 done  |  workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`
+
+**Open tasks:**
+- ! T01 — Make the local administrator a sealed break-glass  `13cd3aec`
+  *(wait: Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02).)*
+- ! T02 — Add the NetKingdom authentication source  `81f072aa`
+  *(wait: Linking and team mapping follow a working authentication source.)*
+- ! T03 — Link accounts and map groups to teams  `32c54737`
+  *(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)*
+- ! T04 — Decide on local password sign-in  `728786c9`
+  *(wait: Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate.)*
+
+### Coulomb-social persistent personal workspace release
+Progress: 3/4 done  |  workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1`
+
+**Open tasks:**
+- ! T04 — Personal sign-in and content acceptance  `8bc4962a`
+
+### Deploy and recover the first invited Vergabe company pilot
+Progress: 2/3 done  |  workplan_id: `c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57`
+
+**Open tasks:**
+- ! Demonstrate restart, isolated restore, rollback and operating ownership  `dd069c6d`
+  *(wait: Await populated two-user/document workflow, coherent PostgreSQL/media/issue-state off-host recovery point, isolated restored workflow, rollback evidence and support ownership. September 25 proves database restore and restart only.)*
+
+## Inbox Hygiene
+
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("financials")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/owner-integration/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,48 @@
+# Work Records — railiance-apps
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| workplan | RAPPS-WP-0014 | blocked | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| workplan | RAPPS-WP-0015 | active | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| workplan | RAPPS-WP-0016 | active | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| workplan | RAPPS-WP-0017 | finished | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T04 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T05 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0002-T01 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T02 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T03 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T04 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T05 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T06 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T07 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0003-T01 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T02 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T03 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0014-T02 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0014-T03 | wait | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0015-T01 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0016-T01 | done | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T05 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0017-T01 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0017-T02 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0017-T03 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |

docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/owner-integration/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 1f9b6fae4362945f96aa9a2a9647be9c83d8296a 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 89c6d25cfe29035a2e0ad71113c31b89338b0cc3 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/owner-integration/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,47 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — railiance-apps
+
+**Domain:** financials  
+**Last synced:** 2026-10-17 10:13 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Forgejo sign-in through NetKingdom, before the forge closes
+Progress: 1/5 done  |  workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`
+
+**Open tasks:**
+- ! T01 — Make the local administrator a sealed break-glass  `13cd3aec`
+  *(wait: Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02).)*
+- ! T02 — Add the NetKingdom authentication source  `81f072aa`
+  *(wait: Linking and team mapping follow a working authentication source.)*
+- ! T03 — Link accounts and map groups to teams  `32c54737`
+  *(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)*
+- ! T04 — Decide on local password sign-in  `728786c9`
+  *(wait: Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate.)*
+
+### Coulomb-social persistent personal workspace release
+Progress: 3/4 done  |  workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1`
+
+**Open tasks:**
+- ! T04 — Personal sign-in and content acceptance  `8bc4962a`
+
+### Deploy and recover the first invited Vergabe company pilot
+Progress: 2/3 done  |  workplan_id: `c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57`
+
+**Open tasks:**
+- ! Demonstrate restart, isolated restore, rollback and operating ownership  `dd069c6d`
+  *(wait: Await populated two-user/document workflow, coherent PostgreSQL/media/issue-state off-host recovery point, isolated restored workflow, rollback evidence and support ownership. September 25 proves database restore and restart only.)*
+
+## Inbox Hygiene
+
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("financials")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/owner-integration/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,48 @@
+# Work Records — railiance-apps
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| workplan | RAPPS-WP-0014 | blocked | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| workplan | RAPPS-WP-0015 | active | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| workplan | RAPPS-WP-0016 | active | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| workplan | RAPPS-WP-0017 | finished | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T04 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0001-T05 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
+| task | RAPPS-WP-0002-T01 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T02 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T03 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T04 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T05 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T06 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0002-T07 | done | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
+| task | RAPPS-WP-0003-T01 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T02 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T03 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
+| task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0014-T02 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0014-T03 | wait | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
+| task | RAPPS-WP-0015-T01 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
+| task | RAPPS-WP-0016-T01 | done | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T05 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0017-T01 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0017-T02 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
+| task | RAPPS-WP-0017-T03 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |

docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/owner-integration/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 1f9b6fae4362945f96aa9a2a9647be9c83d8296a 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 89c6d25cfe29035a2e0ad71113c31b89338b0cc3 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt3.json

@@ -0,0 +1,223 @@
+{
+  "returncode": 0,
+  "seconds": 29.8,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-token-pair-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "./..."
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/online_human_test.go": "sha256:e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:e6905bfa0474dde6122a83a6627d6b75a4c3a7730fb26106546e7a34eef8302b",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/token_pair_test.go": "sha256:efeb929becf61d62111286ead4d3635c1a59bfd34423280084ccfec2169a2b1d",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 726,
+    "fail": 0,
+    "skip": 6
+  },
+  "failures": [],
+  "skips": [
+    "keycape/tests/conformance:TestIssuerAdvertisesItself",
+    "keycape/tests/conformance:TestProfileAuthorizationSurface",
+    "keycape/tests/conformance:TestPublishedKeysAreUsable",
+    "keycape/tests/conformance:TestExcludedGrantsAreNotAdvertised",
+    "keycape/tests/conformance:TestServiceTokenVerifiesAgainstPublishedKeys",
+    "keycape/internal/server/oidc:TestNativeOptionalEnrollmentAndOldSession"
+  ],
+  "source": "/tmp/custodian-keycape-token-pair-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/application.json

@@ -0,0 +1,9 @@
+{
+  "status": "source-applied",
+  "owner": "key-cape",
+  "files": 19,
+  "existing_task_blocks_preserved": 3,
+  "new_source_only_task": "KEY-WP-0042-T04",
+  "all_other_tracked_files_and_index_preserved": true,
+  "native_admission": false
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/consistency.json

@@ -0,0 +1,133 @@
+{
+  "repo_slug": "key-cape",
+  "repo_path": "/home/worsch/key-cape",
+  "source_revision": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-24",
+      "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-33",
+      "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
+      "file_path": "WORK-RECORDS.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
+      "file_path": "workplans/KEY-WP-0007-user-engine-portal-oidc-client.md",
+      "db_id": "",
+      "file_value": "USER-WP-0020",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'NK-WP-0025' is not linked to State Hub",
+      "file_path": "workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md",
+      "db_id": "",
+      "file_value": "NK-WP-0025",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'NK-WP-0030' is not linked to State Hub",
+      "file_path": "workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md",
+      "db_id": "",
+      "file_value": "NK-WP-0030",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'RAILIANCE-WP-0027' is not linked to State Hub",
+      "file_path": "workplans/KEY-WP-0010-openbao-operator-loopback-callback.md",
+      "db_id": "",
+      "file_value": "RAILIANCE-WP-0027",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-23",
+      "message": "Lifecycle drift in 'key-wp-0042': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)",
+      "file_path": "workplans/KEY-WP-0042-online-access-token-status.md",
+      "db_id": "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38",
+      "file_value": "proposed",
+      "db_value": "proposed",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-11",
+      "message": "Derived task 'KEY-WP-0042-T04' is absent from this projection",
+      "file_path": "workplans/KEY-WP-0042-online-access-token-status.md#KEY-WP-0042-T04",
+      "db_id": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'keycape-implementation@retired-20260826' (id=2c9caad8\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "2c9caad8-2ced-492d-9d63-376387b4b9b0",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "3 unread message(s) lack thread_id for supersession tracking: the-custodian:52b0031d, the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 45/45",
+    "C-17 cleared: pushed 1 backlogged commit(s)",
+    "C-33 fixed: regenerated WORK-RECORDS.md",
+    "C-11 fixed: task 'KEY-WP-0042-T04' \u2192 4c71c9f7\u2026",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 10,
+    "info": 1
+  },
+  "result": "warn"
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/consistency.stderr.txt

@@ -0,0 +1 @@
+WARN: git commit failed for writeback: Generated-only commits rejected: staged

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/projection.json

@@ -0,0 +1,200 @@
+{
+  "ok": true,
+  "status": "applied",
+  "repo_slug": "key-cape",
+  "commit": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+  "requests": 2,
+  "elapsed_ms": 7899.5,
+  "git": {
+    "upstream": "origin/main",
+    "behind": 0,
+    "ahead": 0
+  },
+  "identifiers": {
+    "schema": "repo-manager.identifier-assignment.v1",
+    "ok": true,
+    "executed": true,
+    "repo": "key-cape",
+    "namespace": "helixforge",
+    "assignments": [],
+    "historical_invalid_identifiers": [],
+    "historical_identity_collisions": [],
+    "files_changed": []
+  },
+  "receipt": {
+    "schema": "state-hub.repository-projection-reconcile.v1",
+    "instance_role": "primary",
+    "instance_label": "railiance01",
+    "expected_commit": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+    "derived_commit": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+    "outcome": {
+      "schema": "state-hub.projection-reset.v1",
+      "repo_slug": "key-cape",
+      "commit": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+      "status": "applied",
+      "counts": {
+        "created": 0,
+        "updated": 45,
+        "retired": 0,
+        "refused": 0,
+        "released": 0,
+        "created_tasks": 0,
+        "updated_tasks": 1,
+        "cancelled_tasks": 0,
+        "created_edges": 0,
+        "removed_edges": 0,
+        "unresolved_edges": 1,
+        "external_edges": 8
+      },
+      "created": [],
+      "updated": [
+        "ADHOC-2026-09-05",
+        "ADHOC-2026-09-07",
+        "ADHOC-2026-09-27",
+        "KEY-WP-0001",
+        "KEY-WP-0002",
+        "KEY-WP-0003",
+        "KEY-WP-0004",
+        "KEY-WP-0005",
+        "KEY-WP-0006",
+        "KEY-WP-0007",
+        "KEY-WP-0008",
+        "KEY-WP-0009",
+        "KEY-WP-0010",
+        "KEY-WP-0011",
+        "KEY-WP-0012",
+        "KEY-WP-0013",
+        "KEY-WP-0014",
+        "KEY-WP-0015",
+        "KEY-WP-0016",
+        "KEY-WP-0017",
+        "KEY-WP-0018",
+        "KEY-WP-0019",
+        "KEY-WP-0020",
+        "KEY-WP-0021",
+        "KEY-WP-0022",
+        "KEY-WP-0023",
+        "KEY-WP-0024",
+        "KEY-WP-0025",
+        "KEY-WP-0026",
+        "KEY-WP-0027",
+        "KEY-WP-0028",
+        "KEY-WP-0029",
+        "KEY-WP-0030",
+        "KEY-WP-0031",
+        "KEY-WP-0032",
+        "KEY-WP-0033",
+        "KEY-WP-0034",
+        "KEY-WP-0035",
+        "KEY-WP-0036",
+        "KEY-WP-0037",
+        "KEY-WP-0038",
+        "KEY-WP-0039",
+        "KEY-WP-0040",
+        "KEY-WP-0041",
+        "KEY-WP-0042"
+      ],
+      "retired": [],
+      "released": [],
+      "created_tasks": [],
+      "updated_tasks": [
+        "KEY-WP-0042-T04"
+      ],
+      "cancelled_tasks": [],
+      "created_edges": [],
+      "removed_edges": [],
+      "unresolved_edges": [
+        {
+          "workplan": "KEY-WP-0010",
+          "from": "KEY-WP-0010",
+          "target": "RAILIANCE-WP-0027",
+          "reason": "missing"
+        }
+      ],
+      "external_edges": [
+        {
+          "workplan": "KEY-WP-0038",
+          "from": "KEY-WP-0038-T03",
+          "target": "KEY-WP-0038-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
+          "from_task_id": "40ddaa29-7245-508c-ad48-ddc063e25115",
+          "to_workplan_id": null,
+          "to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
+        },
+        {
+          "workplan": "KEY-WP-0038",
+          "from": "KEY-WP-0038-T02",
+          "target": "KEY-WP-0038-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
+          "from_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30",
+          "to_workplan_id": null,
+          "to_task_id": "5f019d13-1fa3-5b88-a27a-75a3339ca96e"
+        },
+        {
+          "workplan": "KEY-WP-0038",
+          "from": "KEY-WP-0038-T02",
+          "target": "NK-WP-0048-T06",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "098e3e2c-a138-560e-b2d3-3a15eb49d8a9",
+          "from_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30",
+          "to_workplan_id": null,
+          "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
+        },
+        {
+          "workplan": "KEY-WP-0039",
+          "from": "KEY-WP-0039-T02",
+          "target": "KEY-WP-0038-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
+          "from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
+          "to_workplan_id": null,
+          "to_task_id": "40ddaa29-7245-508c-ad48-ddc063e25115"
+        },
+        {
+          "workplan": "KEY-WP-0039",
+          "from": "KEY-WP-0039-T02",
+          "target": "KEY-WP-0039-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
+          "from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
+          "to_workplan_id": null,
+          "to_task_id": "4d06b059-3768-53bb-83a4-a9a71c0850b8"
+        },
+        {
+          "workplan": "KEY-WP-0039",
+          "from": "KEY-WP-0039-T02",
+          "target": "KEY-WP-0038-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "09c3bddf-6058-5603-8488-cccdb7be4f86",
+          "from_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
+          "to_workplan_id": null,
+          "to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
+        },
+        {
+          "workplan": "KEY-WP-0007",
+          "from": "KEY-WP-0007",
+          "target": "KEY-WP-0005",
+          "relationship_type": "blocks",
+          "from_workplan_id": "24db4178-705c-5b09-b7db-ee7a345d71a0",
+          "from_task_id": null,
+          "to_workplan_id": "711a8303-69aa-5db6-9043-92530c6dc81b",
+          "to_task_id": null
+        },
+        {
+          "workplan": "KEY-WP-0009",
+          "from": "KEY-WP-0009",
+          "target": "KEY-WP-0006",
+          "relationship_type": "blocks",
+          "from_workplan_id": "c1a9b1cc-2ff0-566a-b544-1a2ef967fc0d",
+          "from_task_id": null,
+          "to_workplan_id": "d8d20d8f-61e0-54e2-9a88-a3958f0b6f2d",
+          "to_task_id": null
+        }
+      ],
+      "refused": [],
+      "notes": []
+    }
+  }
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,37 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — key-cape
+
+**Domain:** infotech  
+**Last synced:** 2026-10-17 02:16 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Negative-check tokens for the secrets-engine OpenBao JWT role
+Progress: 2/3 done  |  workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
+
+**Open tasks:**
+- ! T01 — Define the probe registrations  `03da4c38`
+  *(wait: Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved.)*
+
+### Forgejo as a NetKingdom OIDC client, so the forge can close
+Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
+
+**Open tasks:**
+- ! T01 — Define what Forgejo receives  `ddcfb482`
+  *(wait: Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout.)*
+- ! T02 — Register the client and hand over its secret  `40ddaa29`
+  *(wait: Claims are verified against the registered client.)*
+
+## Inbox Hygiene
+
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,224 @@
+# Work Records — key-cape
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | ADHOC-2026-09-05 | finished | — | workplans/ADHOC-2026-09-05.md |
+| workplan | ADHOC-2026-09-07 | finished | — | workplans/ADHOC-2026-09-07.md |
+| workplan | ADHOC-2026-09-27 | finished | — | workplans/ADHOC-2026-09-27.md |
+| workplan | KEY-WP-0001 | finished | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| workplan | KEY-WP-0002 | finished | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| workplan | KEY-WP-0004 | finished | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| workplan | KEY-WP-0007 | finished | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| workplan | KEY-WP-0008 | finished | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| workplan | KEY-WP-0009 | finished | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| workplan | KEY-WP-0010 | finished | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| workplan | KEY-WP-0011 | finished | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| workplan | KEY-WP-0012 | finished | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| workplan | KEY-WP-0013 | finished | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| workplan | KEY-WP-0014 | finished | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| workplan | KEY-WP-0015 | finished | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| workplan | KEY-WP-0017 | finished | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| workplan | KEY-WP-0018 | finished | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| workplan | KEY-WP-0019 | finished | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| workplan | KEY-WP-0020 | finished | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| workplan | KEY-WP-0021 | finished | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| workplan | KEY-WP-0022 | finished | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| workplan | KEY-WP-0023 | finished | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| workplan | KEY-WP-0024 | finished | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| workplan | KEY-WP-0025 | finished | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| workplan | KEY-WP-0026 | finished | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| workplan | KEY-WP-0027 | finished | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| workplan | KEY-WP-0028 | finished | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| workplan | KEY-WP-0029 | finished | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| workplan | KEY-WP-0030 | finished | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| workplan | KEY-WP-0031 | finished | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| workplan | KEY-WP-0032 | finished | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| workplan | KEY-WP-0033 | finished | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| workplan | KEY-WP-0034 | finished | — | workplans/KEY-WP-0034-account-recovery.md |
+| workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md |
+| workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| workplan | KEY-WP-0038 | active | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| workplan | KEY-WP-0039 | active | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| workplan | KEY-WP-0040 | finished | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| workplan | KEY-WP-0041 | finished | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
+| task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
+| task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
+| task | ADHOC-2026-09-27-T02 | done | — | workplans/ADHOC-2026-09-27.md |
+| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T04 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T05 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T06 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T07 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T08 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T09 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T10 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T11 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T12 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T13 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T14 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T15 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T16 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T17 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T18 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T19 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T20 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T21 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T22 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T23 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0002-T01 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T02 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T03 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T04 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T05 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T06 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0003-T01 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T02 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T03 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T02 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T06 | cancel | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T07 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0005-T01 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0005-T02 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0005-T03 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0007-T01 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0007-T02 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0007-T03 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0008-T01 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T02 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T03 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T04 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0009-T01 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T02 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T03 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T04 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0010-T01 | done | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| task | KEY-WP-0011-T01 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T02 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T03 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0012-T01 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0012-T02 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0012-T03 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0013-T01 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T02 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T03 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T04 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T05 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T06 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T07 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0014-T01 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T02 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T03 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T04 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0015-T01 | done | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| task | KEY-WP-0016-T01 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T02 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T03 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T04 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0017-T01 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T02 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T03 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T04 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0018-T01 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0018-T02 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0018-T03 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0019-T01 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T02 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T03 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T04 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T05 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0020-T01 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0020-T02 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0020-T03 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0021-T01 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0021-T02 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0021-T03 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0022-T01 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T02 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T03 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T04 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T05 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0023-T01 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T02 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T03 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T04 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T05 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0024-T01 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| task | KEY-WP-0024-T02 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| task | KEY-WP-0025-T01 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T02 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T03 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T04 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0026-T01 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T02 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T03 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T04 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T05 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T06 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0027-T01 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T02 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T03 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T04 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0028-T01 | done | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| task | KEY-WP-0028-T02 | done | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| task | KEY-WP-0029-T01 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0029-T02 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0029-T03 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0030-T01 | done | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| task | KEY-WP-0030-T02 | done | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| task | KEY-WP-0031-T01 | done | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| task | KEY-WP-0031-T02 | done | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| task | KEY-WP-0032-T01 | done | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| task | KEY-WP-0032-T02 | done | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| task | KEY-WP-0033-T01 | done | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| task | KEY-WP-0033-T02 | done | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| task | KEY-WP-0034-T01 | done | — | workplans/KEY-WP-0034-account-recovery.md |
+| task | KEY-WP-0034-T02 | done | — | workplans/KEY-WP-0034-account-recovery.md |
+| task | KEY-WP-0035-T01 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T02 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T03 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T04 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T05 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0036-T01 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0036-T02 | cancel | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0036-T03 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0037-T01 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T02 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T03 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T04 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0038-T01 | done | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T02 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T03 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T04 | cancel | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0039-T01 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0039-T02 | wait | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0039-T03 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0040-T01 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0040-T02 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0041-T01 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| task | KEY-WP-0041-T02 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 d3b36c3bffbeb922769a2a788e35b4113fccaa3f 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 d86b29bbc480acfa6d12d5052039578d7d4e380c 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/publication-commit.json

@@ -0,0 +1,85 @@
+{
+  "exit_code": 0,
+  "commit": "08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+  "base": "67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
+  "files": [
+    {
+      "path": "Makefile",
+      "sha256": "fb7c057286017e18c5a10ce7752f09336becffba3e30d9fb9b6a2467e53dcb50"
+    },
+    {
+      "path": "adapters/go/tokenstatus/LICENSE",
+      "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
+    },
+    {
+      "path": "adapters/go/tokenstatus/go.mod",
+      "sha256": "e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54"
+    },
+    {
+      "path": "adapters/go/tokenstatus/internal/jose/jose.go",
+      "sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "adapters/go/tokenstatus/pkg/tokenstatus/client.go",
+      "sha256": "f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
+    },
+    {
+      "path": "adapters/go/tokenstatus/producer-source.json",
+      "sha256": "3bd9b25b912e7c17b331997ca5fee9da8a7c314f336e09e3c116885954799b73"
+    },
+    {
+      "path": "docs/current-token-client.md",
+      "sha256": "69db63087c752bba0b07b41aa7784484703aacc064181782d15de62310751c4e"
+    },
+    {
+      "path": "docs/online-token-status.md",
+      "sha256": "56064b1c0df5ff9a20d5c205396e7b1b2d0d70785ea7945c999d34b4de3aa1b8"
+    },
+    {
+      "path": "src/cmd/keycape/main.go",
+      "sha256": "553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0"
+    },
+    {
+      "path": "src/internal/authclient/cli.go",
+      "sha256": "009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c"
+    },
+    {
+      "path": "src/internal/authclient/online.go",
+      "sha256": "182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a"
+    },
+    {
+      "path": "src/internal/authclient/online_cli.go",
+      "sha256": "6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2"
+    },
+    {
+      "path": "src/internal/authclient/online_cli_test.go",
+      "sha256": "5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f"
+    },
+    {
+      "path": "src/internal/authclient/online_export_test.go",
+      "sha256": "5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba"
+    },
+    {
+      "path": "src/internal/authclient/online_human_test.go",
+      "sha256": "e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0"
+    },
+    {
+      "path": "src/internal/authclient/online_test.go",
+      "sha256": "6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a"
+    },
+    {
+      "path": "src/internal/jose/jose.go",
+      "sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "tools/export_tokenstatus_client.py",
+      "sha256": "c05cc75de87c9d7bd9d184c012c4ab8d273da36934c8908c05d7c72192db218e"
+    },
+    {
+      "path": "workplans/KEY-WP-0042-online-access-token-status.md",
+      "sha256": "e8b0d15d7461ea34075b4a7f8047af380d96e521f42a0dae6136f6cfdd052b0f"
+    }
+  ],
+  "stdout": "[main 08c083b] Share current-token verification and scoped cleanup through one producer client\n 19 files changed, 2228 insertions(+), 3 deletions(-)\n create mode 100644 adapters/go/tokenstatus/LICENSE\n create mode 100644 adapters/go/tokenstatus/go.mod\n create mode 100644 adapters/go/tokenstatus/internal/jose/jose.go\n create mode 100644 adapters/go/tokenstatus/pkg/tokenstatus/client.go\n create mode 100644 adapters/go/tokenstatus/producer-source.json\n create mode 100644 docs/current-token-client.md\n create mode 100644 src/internal/authclient/online.go\n create mode 100644 src/internal/authclient/online_cli.go\n create mode 100644 src/internal/authclient/online_cli_test.go\n create mode 100644 src/internal/authclient/online_export_test.go\n create mode 100644 src/internal/authclient/online_human_test.go\n create mode 100644 src/internal/authclient/online_test.go\n create mode 100644 tools/export_tokenstatus_client.py\n",
+  "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-application/publication-inputs.json

@@ -0,0 +1,83 @@
+{
+  "owner": "key-cape",
+  "base_revision": "67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
+  "message": "Share current-token verification and scoped cleanup through one producer client",
+  "files": [
+    {
+      "path": "Makefile",
+      "sha256": "fb7c057286017e18c5a10ce7752f09336becffba3e30d9fb9b6a2467e53dcb50"
+    },
+    {
+      "path": "adapters/go/tokenstatus/LICENSE",
+      "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
+    },
+    {
+      "path": "adapters/go/tokenstatus/go.mod",
+      "sha256": "e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54"
+    },
+    {
+      "path": "adapters/go/tokenstatus/internal/jose/jose.go",
+      "sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "adapters/go/tokenstatus/pkg/tokenstatus/client.go",
+      "sha256": "f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
+    },
+    {
+      "path": "adapters/go/tokenstatus/producer-source.json",
+      "sha256": "3bd9b25b912e7c17b331997ca5fee9da8a7c314f336e09e3c116885954799b73"
+    },
+    {
+      "path": "docs/current-token-client.md",
+      "sha256": "69db63087c752bba0b07b41aa7784484703aacc064181782d15de62310751c4e"
+    },
+    {
+      "path": "docs/online-token-status.md",
+      "sha256": "56064b1c0df5ff9a20d5c205396e7b1b2d0d70785ea7945c999d34b4de3aa1b8"
+    },
+    {
+      "path": "src/cmd/keycape/main.go",
+      "sha256": "553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0"
+    },
+    {
+      "path": "src/internal/authclient/cli.go",
+      "sha256": "009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c"
+    },
+    {
+      "path": "src/internal/authclient/online.go",
+      "sha256": "182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a"
+    },
+    {
+      "path": "src/internal/authclient/online_cli.go",
+      "sha256": "6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2"
+    },
+    {
+      "path": "src/internal/authclient/online_cli_test.go",
+      "sha256": "5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f"
+    },
+    {
+      "path": "src/internal/authclient/online_export_test.go",
+      "sha256": "5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba"
+    },
+    {
+      "path": "src/internal/authclient/online_human_test.go",
+      "sha256": "e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0"
+    },
+    {
+      "path": "src/internal/authclient/online_test.go",
+      "sha256": "6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a"
+    },
+    {
+      "path": "src/internal/jose/jose.go",
+      "sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "tools/export_tokenstatus_client.py",
+      "sha256": "c05cc75de87c9d7bd9d184c012c4ab8d273da36934c8908c05d7c72192db218e"
+    },
+    {
+      "path": "workplans/KEY-WP-0042-online-access-token-status.md",
+      "sha256": "e8b0d15d7461ea34075b4a7f8047af380d96e521f42a0dae6136f6cfdd052b0f"
+    }
+  ]
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/application.json

@@ -0,0 +1,9 @@
+{
+  "status": "source-applied",
+  "owner": "ops-warden",
+  "files": 4,
+  "original_task_blocks_preserved": 4,
+  "other_tracked_files_and_index_preserved": true,
+  "catalog_or_generated_artifact_changed": false,
+  "native_authority": false
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/consistency.json

@@ -0,0 +1,141 @@
+{
+  "repo_slug": "ops-warden",
+  "repo_path": "/home/worsch/ops-warden",
+  "source_revision": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-24",
+      "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-42",
+      "message": "Blocked workplan 'warden-wp-0027' has no task in status wait \u2014 nothing states what it waits for; qualify a wait task or re-status the workplan",
+      "file_path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md",
+      "db_id": "21528e8d-a049-523d-9ae1-da7a27cb8bbf",
+      "file_value": "blocked",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'warden-wp-0034' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md",
+      "db_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-40",
+      "message": "blocker satisfied, task still wait: 'WARDEN-WP-0037-T03' in workplan 'WARDEN-WP-0037' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
+      "file_path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md#WARDEN-WP-0037-T03",
+      "db_id": "",
+      "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-37",
+      "message": "Residual workplan 'warden-wp-0040' has no origin/origin_ref provenance (not invented)",
+      "file_path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md",
+      "db_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-06-29@retired-20260828' (id=1c0460b7\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "1c0460b7-bc8a-48db-96d4-681bce18ac91",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-08-17@retired-20260827' (id=8376eb89\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "8376eb89-36f2-52b0-a59a-2954b2e49349",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-08-11@retired-20260827' (id=bc6dd3e3\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "bc6dd3e3-ab2b-567a-9574-30d2650f20a2",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'ops-warden-adhoc-2026-06-27@retired-20260827' (id=142b171b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "142b171b-c34b-4a45-91a5-c77e6d07ec6f",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'adhoc-2026-07-07@retired-20260827' (id=2e8bc783\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "2e8bc783-2e37-4b86-a691-177b18329783",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "4 unread inbox message(s) older than 3 day(s): the-custodian:d422aecb, railiance-platform:b3b9fcd8, the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "4 unread message(s) lack thread_id for supersession tracking: the-custodian:fa687c42, the-custodian:d422aecb, the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 51/51",
+    "C-17 cleared: pushed 1 backlogged commit(s)",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 7,
+    "info": 5
+  },
+  "result": "warn"
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/consistency.stderr.txt

@@ -0,0 +1 @@
+WARN: git commit failed for writeback: Generated-only commits rejected: staged

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/projection.json

@@ -0,0 +1,287 @@
+{
+  "ok": true,
+  "status": "applied",
+  "repo_slug": "ops-warden",
+  "commit": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+  "requests": 2,
+  "elapsed_ms": 4638.5,
+  "git": {
+    "upstream": "origin/main",
+    "behind": 0,
+    "ahead": 0
+  },
+  "identifiers": {
+    "schema": "repo-manager.identifier-assignment.v1",
+    "ok": true,
+    "executed": true,
+    "repo": "ops-warden",
+    "namespace": "helixforge",
+    "assignments": [],
+    "historical_invalid_identifiers": [],
+    "historical_identity_collisions": [],
+    "files_changed": []
+  },
+  "receipt": {
+    "schema": "state-hub.repository-projection-reconcile.v1",
+    "instance_role": "primary",
+    "instance_label": "railiance01",
+    "expected_commit": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+    "derived_commit": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+    "outcome": {
+      "schema": "state-hub.projection-reset.v1",
+      "repo_slug": "ops-warden",
+      "commit": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+      "status": "applied",
+      "counts": {
+        "created": 0,
+        "updated": 51,
+        "retired": 0,
+        "refused": 0,
+        "released": 0,
+        "created_tasks": 0,
+        "updated_tasks": 0,
+        "cancelled_tasks": 0,
+        "created_edges": 0,
+        "removed_edges": 0,
+        "unresolved_edges": 0,
+        "external_edges": 17
+      },
+      "created": [],
+      "updated": [
+        "WARDEN-WP-0001",
+        "WARDEN-WP-0002",
+        "WARDEN-WP-0003",
+        "WARDEN-WP-0004",
+        "WARDEN-WP-0005",
+        "WARDEN-WP-0006",
+        "WARDEN-WP-0007",
+        "WARDEN-WP-0008",
+        "WARDEN-WP-0009",
+        "WARDEN-WP-0010",
+        "WARDEN-WP-0011",
+        "WARDEN-WP-0012",
+        "WARDEN-WP-0013",
+        "WARDEN-WP-0014",
+        "WARDEN-WP-0015",
+        "WARDEN-WP-0016",
+        "WARDEN-WP-0017",
+        "WARDEN-WP-0018",
+        "WARDEN-WP-0019",
+        "WARDEN-WP-0020",
+        "WARDEN-WP-0021",
+        "WARDEN-WP-0022",
+        "WARDEN-WP-0023",
+        "WARDEN-WP-0024",
+        "WARDEN-WP-0025",
+        "WARDEN-WP-0026",
+        "WARDEN-WP-0027",
+        "WARDEN-WP-0028",
+        "WARDEN-WP-0029",
+        "WARDEN-WP-0030",
+        "WARDEN-WP-0031",
+        "WARDEN-WP-0032",
+        "WARDEN-WP-0033",
+        "WARDEN-WP-0034",
+        "WARDEN-WP-0035",
+        "WARDEN-WP-0036",
+        "WARDEN-WP-0037",
+        "WARDEN-WP-0038",
+        "WARDEN-WP-0039",
+        "WARDEN-WP-0040",
+        "WARDEN-WP-0041",
+        "WARDEN-WP-0042",
+        "WARDEN-WP-0043",
+        "WARDEN-WP-0044",
+        "WARDEN-WP-ADHOC-2026-06-27",
+        "WARDEN-WP-ADHOC-2026-06-29",
+        "WARDEN-WP-ADHOC-2026-07-07",
+        "WARDEN-WP-ADHOC-2026-08-11",
+        "WARDEN-WP-ADHOC-2026-08-17",
+        "WARDEN-WP-ADHOC-2026-09-08",
+        "WARDEN-WP-ADHOC-2026-10-03"
+      ],
+      "retired": [],
+      "released": [],
+      "created_tasks": [],
+      "updated_tasks": [],
+      "cancelled_tasks": [],
+      "created_edges": [],
+      "removed_edges": [],
+      "unresolved_edges": [],
+      "external_edges": [
+        {
+          "workplan": "WARDEN-WP-0032",
+          "from": "WARDEN-WP-0032",
+          "target": "WARDEN-WP-0031",
+          "relationship_type": "blocks",
+          "from_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6",
+          "from_task_id": null,
+          "to_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0037",
+          "from": "WARDEN-WP-0037-T03",
+          "target": "SECRETS-WP-0006-T06",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "42a097db-1c24-558e-a724-030bb2b4443e",
+          "from_task_id": "a8b1b855-ab34-5835-b9fd-5f48bc0b6817",
+          "to_workplan_id": null,
+          "to_task_id": "1431edae-5791-5892-8c4b-829419b537d2"
+        },
+        {
+          "workplan": "WARDEN-WP-0033",
+          "from": "WARDEN-WP-0033",
+          "target": "WARDEN-WP-0030",
+          "relationship_type": "blocks",
+          "from_workplan_id": "4627d89b-4b00-562a-81e9-76e96f90fa7e",
+          "from_task_id": null,
+          "to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0013",
+          "from": "WARDEN-WP-0013",
+          "target": "WARDEN-WP-0011",
+          "relationship_type": "blocks",
+          "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
+          "from_task_id": null,
+          "to_workplan_id": "0a520f8e-01b4-48f1-9af3-2f3f69fd0672",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0013",
+          "from": "WARDEN-WP-0013",
+          "target": "WARDEN-WP-0009",
+          "relationship_type": "blocks",
+          "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
+          "from_task_id": null,
+          "to_workplan_id": "9213b262-e2f5-480e-a5bc-56635d5eb4c9",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0013",
+          "from": "WARDEN-WP-0013",
+          "target": "WARDEN-WP-0008",
+          "relationship_type": "blocks",
+          "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
+          "from_task_id": null,
+          "to_workplan_id": "a174963a-4ff1-4565-b19f-896cd4ff14a0",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0013",
+          "from": "WARDEN-WP-0013",
+          "target": "WARDEN-WP-0010",
+          "relationship_type": "blocks",
+          "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258",
+          "from_task_id": null,
+          "to_workplan_id": "e93de9fd-0192-4d02-bb7c-5e859fb76b9b",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0031",
+          "from": "WARDEN-WP-0031",
+          "target": "WARDEN-WP-0007",
+          "relationship_type": "blocks",
+          "from_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c",
+          "from_task_id": null,
+          "to_workplan_id": "3718ac07-2fa2-47d0-a02a-c9a7b83a5ba9",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0038",
+          "from": "WARDEN-WP-0038",
+          "target": "WARDEN-WP-0029",
+          "relationship_type": "blocks",
+          "from_workplan_id": "751ad530-e44b-52c4-b70e-cb47568a0179",
+          "from_task_id": null,
+          "to_workplan_id": "bbb3d9ec-d88d-5088-b4c0-55bfba0a10cf",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0023",
+          "from": "WARDEN-WP-0023",
+          "target": "WARDEN-WP-0022",
+          "relationship_type": "blocks",
+          "from_workplan_id": "7bad1ec4-a7c2-4980-b8f9-49a7f5408574",
+          "from_task_id": null,
+          "to_workplan_id": "fc8afa28-68a7-4250-a19e-9754829f0cd5",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0034",
+          "from": "WARDEN-WP-0034",
+          "target": "WARDEN-WP-0030",
+          "relationship_type": "blocks",
+          "from_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
+          "from_task_id": null,
+          "to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0040",
+          "from": "WARDEN-WP-0040",
+          "target": "WARDEN-WP-0032",
+          "relationship_type": "blocks",
+          "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
+          "from_task_id": null,
+          "to_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0040",
+          "from": "WARDEN-WP-0040",
+          "target": "WARDEN-WP-0034",
+          "relationship_type": "blocks",
+          "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
+          "from_task_id": null,
+          "to_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef",
+          "to_task_id": null
+        },
+        {
+          "workplan": "WARDEN-WP-0040",
+          "from": "WARDEN-WP-0040-T03",
+          "target": "WARDEN-WP-0040-T01",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec",
+          "from_task_id": "93eaf1f2-daaa-5e22-8804-85ca9433571c",
+          "to_workplan_id": null,
+          "to_task_id": "611f0901-9fb5-5954-8dd0-a860c5f0cbec"
+        },
+        {
+          "workplan": "WARDEN-WP-0044",
+          "from": "WARDEN-WP-0044-T04",
+          "target": "WARDEN-WP-0044-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
+          "from_task_id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
+          "to_workplan_id": null,
+          "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
+        },
+        {
+          "workplan": "WARDEN-WP-0044",
+          "from": "WARDEN-WP-0044-T03",
+          "target": "MASON-WP-0010-T03",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
+          "from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
+          "to_workplan_id": null,
+          "to_task_id": "56cea6be-c613-586c-80cd-125340b374da"
+        },
+        {
+          "workplan": "WARDEN-WP-0044",
+          "from": "WARDEN-WP-0044-T03",
+          "target": "WARDEN-WP-0044-T02",
+          "relationship_type": "starts_after",
+          "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
+          "from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
+          "to_workplan_id": null,
+          "to_task_id": "5f68c991-f490-58f8-a121-92f74073d272"
+        }
+      ],
+      "refused": [],
+      "notes": []
+    }
+  }
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,60 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — ops-warden
+
+**Domain:** infotech  
+**Last synced:** 2026-10-16 00:05 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Adopt unknown -> fail_closed behind signing-target classification coverage
+Progress: 1/4 done  |  workplan_id: `c8ee441e-1be1-5219-910c-e79ff23cc9ec`
+
+**Open tasks:**
+- ! Tasks  `611f0901`
+  *(wait: Warden's own declaration cannot classify the repair-path target workloads; the owner must declare the continuity actor/target and its z2-continuity resolution (see 2026-09-28 review).)*
+- ! Tasks  `54ad4864`
+  *(wait: Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily declared by activity-core and compiled 2026-10-09 (z2-protected, admission unsatisfied: M1 below M2 floor).)*
+- ! Tasks  `93eaf1f2`
+  *(wait: Gated on T01 and on layer model v0.8 (or successor) reaching accepted; never convert against a proposed standard.)*
+
+### Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule
+Progress: 5/6 done  |  workplan_id: `ae3ff76f-883d-5e2f-b6aa-144d61e8fdef`
+
+**Open tasks:**
+- ! Tasks  `7d1b3c82`
+  *(wait: Two items to route, not absorb: ops-mason has published no stance map; the second is another repository's to own.)*
+
+### Follow through on KnownSecurityCases along their type's route
+Progress: 2/4 done  |  workplan_id: `f7e81013-6868-5d99-8528-ba75a442eca9`
+
+**Open tasks:**
+- ! T03 — Run and verify a case  `4a0fa4a7`
+  *(wait: Catalog integration follows a proven run.)*
+- ► T02 — Plan a case run  `bcbf6c91`
+
+### Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
+Progress: 2/3 done  |  workplan_id: `21528e8d-a049-523d-9ae1-da7a27cb8bbf`
+
+**Open tasks:**
+- · Task: Graded lockdown / break-glass with explicit trust-root  `cae498ee`
+
+### Repoint the whynot-design npm lane to Forgejo
+Progress: 2/3 done  |  workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e`
+
+**Open tasks:**
+- ! Prove routing and publication  `a8b1b855`
+  *(wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)*
+
+## Inbox Hygiene
+
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 3 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,188 @@
+# Work Records — ops-warden
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | WARDEN-WP-ADHOC-2026-06-27 | finished | — | workplans/ADHOC-2026-06-27.md |
+| workplan | WARDEN-WP-ADHOC-2026-06-29 | finished | — | workplans/ADHOC-2026-06-29.md |
+| workplan | WARDEN-WP-ADHOC-2026-08-11 | finished | — | workplans/ADHOC-2026-08-11.md |
+| workplan | WARDEN-WP-ADHOC-2026-08-17 | finished | — | workplans/ADHOC-2026-08-17.md |
+| workplan | WARDEN-WP-ADHOC-2026-09-08 | finished | — | workplans/ADHOC-2026-09-08.md |
+| workplan | WARDEN-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
+| workplan | WARDEN-WP-0016 | finished | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| workplan | WARDEN-WP-0017 | finished | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| workplan | WARDEN-WP-0018 | finished | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| workplan | WARDEN-WP-0019 | finished | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| workplan | WARDEN-WP-0020 | finished | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| workplan | WARDEN-WP-0021 | finished | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| workplan | WARDEN-WP-0022 | finished | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| workplan | WARDEN-WP-0023 | finished | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| workplan | WARDEN-WP-0024 | finished | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| workplan | WARDEN-WP-0025 | finished | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| workplan | WARDEN-WP-0026 | finished | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| workplan | WARDEN-WP-0027 | blocked | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| workplan | WARDEN-WP-0028 | finished | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| workplan | WARDEN-WP-0029 | finished | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| workplan | WARDEN-WP-0030 | finished | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| workplan | WARDEN-WP-0031 | finished | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| workplan | WARDEN-WP-0032 | finished | — | workplans/WARDEN-WP-0032-security-zones.md |
+| workplan | WARDEN-WP-0033 | finished | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| workplan | WARDEN-WP-0034 | active | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| workplan | WARDEN-WP-0035 | finished | — | workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md |
+| workplan | WARDEN-WP-0036 | finished | — | workplans/WARDEN-WP-0036-attended-login-openbao-output.md |
+| workplan | WARDEN-WP-0037 | blocked | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
+| workplan | WARDEN-WP-0038 | finished | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md |
+| workplan | WARDEN-WP-0039 | finished | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
+| workplan | WARDEN-WP-0040 | active | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| workplan | WARDEN-WP-0041 | finished | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
+| workplan | WARDEN-WP-0042 | finished | — | workplans/WARDEN-WP-0042-openbao-structure-survey-route.md |
+| workplan | WARDEN-WP-0043 | finished | — | workplans/WARDEN-WP-0043-platform-supplier-credentials.md |
+| workplan | WARDEN-WP-0044 | active | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
+| task | WARDEN-WP-ADHOC-2026-06-27-T01 | done | — | workplans/ADHOC-2026-06-27.md |
+| task | WARDEN-WP-ADHOC-2026-06-29-T01 | done | — | workplans/ADHOC-2026-06-29.md |
+| task | WARDEN-WP-ADHOC-2026-08-11-T01 | done | — | workplans/ADHOC-2026-08-11.md |
+| task | WARDEN-WP-ADHOC-2026-08-11-T02 | done | — | workplans/ADHOC-2026-08-11.md |
+| task | WARDEN-WP-ADHOC-2026-08-11-T03 | done | — | workplans/ADHOC-2026-08-11.md |
+| task | WARDEN-WP-ADHOC-2026-08-17-T01 | done | — | workplans/ADHOC-2026-08-17.md |
+| task | WARDEN-WP-ADHOC-2026-08-17-T02 | done | — | workplans/ADHOC-2026-08-17.md |
+| task | WARDEN-WP-ADHOC-2026-08-17-T03 | done | — | workplans/ADHOC-2026-08-17.md |
+| task | WARDEN-WP-ADHOC-2026-08-17-T04 | done | — | workplans/ADHOC-2026-08-17.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T01 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T02 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T03 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T04 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T05 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-09-08-T06 | done | — | workplans/ADHOC-2026-09-08.md |
+| task | WARDEN-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
+| task | WARDEN-WP-0016-T01 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T02 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T03 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T04 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0017-T01 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0017-T02 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0017-T03 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0018-T01 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0018-T02 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0018-T03 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0019-T01 | done | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| task | WARDEN-WP-0019-T02 | done | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| task | WARDEN-WP-0020-T01 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T02 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T03 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T04 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T05 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0021-T01 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T02 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T03 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T04 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T05 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0022-T01 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T02 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T03 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T04 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0023-T01 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T02 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T03 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T04 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T05 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T06 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T07 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0024-T01 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T02 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T03 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T04 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T05 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T06 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T07 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0025-T01 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T02 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T03 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T04 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T05 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0026-T01 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T02 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T03 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T04 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T05 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T06 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T07 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0027-T01 | cancel | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0027-T02 | todo | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0027-T03 | cancel | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0028-T01 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T02 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T03 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T04 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T05 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T06 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T07 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0029-T01 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T02 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T03 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T04 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T05 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0030-T01 | done | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| task | WARDEN-WP-0030-T02 | done | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| task | WARDEN-WP-0030-T03 | done | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| task | WARDEN-WP-0030-T04 | done | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| task | WARDEN-WP-0030-T05 | done | — | workplans/WARDEN-WP-0030-delegation-register.md |
+| task | WARDEN-WP-0031-T01 | done | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| task | WARDEN-WP-0031-T02 | done | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| task | WARDEN-WP-0031-T03 | done | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| task | WARDEN-WP-0031-T04 | done | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| task | WARDEN-WP-0031-T05 | cancel | — | workplans/WARDEN-WP-0031-policy-caller-identity.md |
+| task | WARDEN-WP-0032-T01 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T02 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T03 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T04 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T05 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T06 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T07 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0033-T01 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0033-T02 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0033-T03 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0033-T04 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0033-T05 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0033-T06 | done | — | workplans/WARDEN-WP-0033-native-lane-handoff.md |
+| task | WARDEN-WP-0034-T01 | done | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0034-T02 | done | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0034-T03 | done | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0034-T04 | done | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0034-T05 | wait | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0034-T06 | done | — | workplans/WARDEN-WP-0034-layer-model-v07-conformance.md |
+| task | WARDEN-WP-0035-T01 | done | — | workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md |
+| task | WARDEN-WP-0035-T02 | done | — | workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md |
+| task | WARDEN-WP-0036-T01 | done | — | workplans/WARDEN-WP-0036-attended-login-openbao-output.md |
+| task | WARDEN-WP-0036-T02 | done | — | workplans/WARDEN-WP-0036-attended-login-openbao-output.md |
+| task | WARDEN-WP-0037-T01 | done | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
+| task | WARDEN-WP-0037-T02 | done | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
+| task | WARDEN-WP-0037-T03 | wait | — | workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md |
+| task | WARDEN-WP-0038-T01 | done | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md |
+| task | WARDEN-WP-0039-T01 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
+| task | WARDEN-WP-0039-T02 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
+| task | WARDEN-WP-0039-T03 | done | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
+| task | WARDEN-WP-0040-T01 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| task | WARDEN-WP-0040-T02 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| task | WARDEN-WP-0040-T03 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| task | WARDEN-WP-0040-T04 | done | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
+| task | WARDEN-WP-0041-T01 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
+| task | WARDEN-WP-0041-T02 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
+| task | WARDEN-WP-0041-T03 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
+| task | WARDEN-WP-0041-T04 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
+| task | WARDEN-WP-0042-T01 | done | — | workplans/WARDEN-WP-0042-openbao-structure-survey-route.md |
+| task | WARDEN-WP-0042-T02 | done | — | workplans/WARDEN-WP-0042-openbao-structure-survey-route.md |
+| task | WARDEN-WP-0043-T01 | done | — | workplans/WARDEN-WP-0043-platform-supplier-credentials.md |
+| task | WARDEN-WP-0043-T02 | done | — | workplans/WARDEN-WP-0043-platform-supplier-credentials.md |
+| task | WARDEN-WP-0043-T03 | done | — | workplans/WARDEN-WP-0043-platform-supplier-credentials.md |
+| task | WARDEN-WP-0044-T01 | done | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
+| task | WARDEN-WP-0044-T02 | done | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
+| task | WARDEN-WP-0044-T03 | progress | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
+| task | WARDEN-WP-0044-T04 | wait | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
+| intake | WARDEN-IN-0001 | closed | — | intakes/intakes.md |
+| intake | WARDEN-IN-0002 | closed | — | intakes/intakes.md |
+| intake | WARDEN-IN-0003 | closed | — | intakes/intakes.md |

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 34573d262327057c11628ce8a7ca78292968545b 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 34cf268862326a5832a7d0be9e84eb296e5601bb 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/publication-commit.json

@@ -0,0 +1,25 @@
+{
+  "exit_code": 0,
+  "commit": "08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+  "base": "b593c879831378db7dc62adfabdfedf2d44ddd38",
+  "files": [
+    {
+      "path": "src/warden/case_run.py",
+      "sha256": "6bc06faf727db42810e4db2ab228cf60f52ede1e48d2b65d03d0a67492bd3c97"
+    },
+    {
+      "path": "tests/test_case_current_session_reference.py",
+      "sha256": "7013ad1b30a0648cb83a78102def02340c6af3ebc284877335b71b080fced720"
+    },
+    {
+      "path": "docs/security-case-execution-kernel-v1.md",
+      "sha256": "4055f8cee7688dd45a2026c6e1927d178bc38f4a7dbcf9736ef8fc3fcd9d8e4a"
+    },
+    {
+      "path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
+      "sha256": "f67f434a05df28c936e6e35dbe1a0623f6915e4bc8df2f0263d1c030aaad8714"
+    }
+  ],
+  "verification": "normal direct git commit terminal exit 0; exact tree/parent and unrelated metadata/index verified",
+  "initial_preparation_failure": "sandbox denied owner Git index write; retried exact staging/normal commit with filesystem approval; hooks unchanged"
+}

docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-application/publication-inputs.json

@@ -0,0 +1,23 @@
+{
+  "owner": "ops-warden",
+  "base_revision": "b593c879831378db7dc62adfabdfedf2d44ddd38",
+  "message": "Keep original case provenance while revalidating a fresh caller session",
+  "files": [
+    {
+      "path": "src/warden/case_run.py",
+      "sha256": "6bc06faf727db42810e4db2ab228cf60f52ede1e48d2b65d03d0a67492bd3c97"
+    },
+    {
+      "path": "tests/test_case_current_session_reference.py",
+      "sha256": "7013ad1b30a0648cb83a78102def02340c6af3ebc284877335b71b080fced720"
+    },
+    {
+      "path": "docs/security-case-execution-kernel-v1.md",
+      "sha256": "4055f8cee7688dd45a2026c6e1927d178bc38f4a7dbcf9736ef8fc3fcd9d8e4a"
+    },
+    {
+      "path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
+      "sha256": "f67f434a05df28c936e6e35dbe1a0623f6915e4bc8df2f0263d1c030aaad8714"
+    }
+  ]
+}

docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/owner-publication/publication-backup/.custodian-brief.md.worktree

@@ -0,0 +1,37 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — key-cape
+
+**Domain:** infotech  
+**Last synced:** 2026-10-18 01:51 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+### Negative-check tokens for the secrets-engine OpenBao JWT role
+Progress: 2/3 done  |  workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
+
+**Open tasks:**
+- ! T02 — Register the probe clients, run the attended probe, then remove them  `03da4c38`
+  *(wait: Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; original secrets-engine-openbao registration go remains resolved; probe/coding-client custody and attended readiness are not established.)*
+
+### Forgejo as a NetKingdom OIDC client, so the forge can close
+Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
+
+**Open tasks:**
+- ! T02 — Register the client and hand over its secret  `ddcfb482`
+  *(wait: Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout.)*
+- ! T03 — Prove the claims for each kind of identity  `40ddaa29`
+  *(wait: Claims are verified against the registered client.)*
+
+## Inbox Hygiene
+
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("infotech")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/owner-publication/publication-backup/WORK-RECORDS.md.worktree

@@ -0,0 +1,224 @@
+# Work Records — key-cape
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | ADHOC-2026-09-05 | finished | — | workplans/ADHOC-2026-09-05.md |
+| workplan | ADHOC-2026-09-07 | finished | — | workplans/ADHOC-2026-09-07.md |
+| workplan | ADHOC-2026-09-27 | finished | — | workplans/ADHOC-2026-09-27.md |
+| workplan | KEY-WP-0001 | finished | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| workplan | KEY-WP-0002 | finished | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| workplan | KEY-WP-0004 | finished | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| workplan | KEY-WP-0007 | finished | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| workplan | KEY-WP-0008 | finished | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| workplan | KEY-WP-0009 | finished | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| workplan | KEY-WP-0010 | finished | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| workplan | KEY-WP-0011 | finished | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| workplan | KEY-WP-0012 | finished | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| workplan | KEY-WP-0013 | finished | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| workplan | KEY-WP-0014 | finished | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| workplan | KEY-WP-0015 | finished | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| workplan | KEY-WP-0017 | finished | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| workplan | KEY-WP-0018 | finished | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| workplan | KEY-WP-0019 | finished | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| workplan | KEY-WP-0020 | finished | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| workplan | KEY-WP-0021 | finished | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| workplan | KEY-WP-0022 | finished | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| workplan | KEY-WP-0023 | finished | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| workplan | KEY-WP-0024 | finished | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| workplan | KEY-WP-0025 | finished | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| workplan | KEY-WP-0026 | finished | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| workplan | KEY-WP-0027 | finished | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| workplan | KEY-WP-0028 | finished | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| workplan | KEY-WP-0029 | finished | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| workplan | KEY-WP-0030 | finished | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| workplan | KEY-WP-0031 | finished | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| workplan | KEY-WP-0032 | finished | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| workplan | KEY-WP-0033 | finished | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| workplan | KEY-WP-0034 | finished | — | workplans/KEY-WP-0034-account-recovery.md |
+| workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md |
+| workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| workplan | KEY-WP-0038 | active | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| workplan | KEY-WP-0039 | active | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| workplan | KEY-WP-0040 | finished | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| workplan | KEY-WP-0041 | finished | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
+| task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
+| task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
+| task | ADHOC-2026-09-27-T02 | done | — | workplans/ADHOC-2026-09-27.md |
+| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T04 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T05 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T06 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T07 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T08 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T09 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T10 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T11 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T12 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T13 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T14 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T15 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T16 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T17 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T18 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T19 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T20 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T21 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T22 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0001-T23 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
+| task | KEY-WP-0002-T01 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T02 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T03 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T04 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T05 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0002-T06 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
+| task | KEY-WP-0003-T01 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T02 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T03 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
+| task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T02 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T06 | cancel | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0004-T07 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
+| task | KEY-WP-0005-T01 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0005-T02 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0005-T03 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
+| task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
+| task | KEY-WP-0007-T01 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0007-T02 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0007-T03 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
+| task | KEY-WP-0008-T01 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T02 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T03 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0008-T04 | done | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
+| task | KEY-WP-0009-T01 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T02 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T03 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T04 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0010-T01 | done | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| task | KEY-WP-0011-T01 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T02 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T03 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0012-T01 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0012-T02 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0012-T03 | done | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
+| task | KEY-WP-0013-T01 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T02 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T03 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T04 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T05 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T06 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0013-T07 | done | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
+| task | KEY-WP-0014-T01 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T02 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T03 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0014-T04 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
+| task | KEY-WP-0015-T01 | done | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| task | KEY-WP-0016-T01 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T02 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T03 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T04 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0017-T01 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T02 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T03 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T04 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0018-T01 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0018-T02 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0018-T03 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md |
+| task | KEY-WP-0019-T01 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T02 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T03 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T04 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0019-T05 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md |
+| task | KEY-WP-0020-T01 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0020-T02 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0020-T03 | done | — | workplans/KEY-WP-0020-migration-contract-preservation.md |
+| task | KEY-WP-0021-T01 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0021-T02 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0021-T03 | done | — | workplans/KEY-WP-0021-snapshot-attribute-validation.md |
+| task | KEY-WP-0022-T01 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T02 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T03 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T04 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0022-T05 | done | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
+| task | KEY-WP-0023-T01 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T02 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T03 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T04 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0023-T05 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
+| task | KEY-WP-0024-T01 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| task | KEY-WP-0024-T02 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| task | KEY-WP-0025-T01 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T02 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T03 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T04 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0026-T01 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T02 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T03 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T04 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T05 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T06 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0027-T01 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T02 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T03 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T04 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0028-T01 | done | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| task | KEY-WP-0028-T02 | done | — | workplans/KEY-WP-0028-browser-client-field-validation.md |
+| task | KEY-WP-0029-T01 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0029-T02 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0029-T03 | done | — | workplans/KEY-WP-0029-scope-reassessment.md |
+| task | KEY-WP-0030-T01 | done | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| task | KEY-WP-0030-T02 | done | — | workplans/KEY-WP-0030-tenant-precondition-guard.md |
+| task | KEY-WP-0031-T01 | done | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| task | KEY-WP-0031-T02 | done | — | workplans/KEY-WP-0031-gate-house-tenant-ruling.md |
+| task | KEY-WP-0032-T01 | done | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| task | KEY-WP-0032-T02 | done | — | workplans/KEY-WP-0032-principal-type-provenance-guard.md |
+| task | KEY-WP-0033-T01 | done | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| task | KEY-WP-0033-T02 | done | — | workplans/KEY-WP-0033-vergabe-fresh-login.md |
+| task | KEY-WP-0034-T01 | done | — | workplans/KEY-WP-0034-account-recovery.md |
+| task | KEY-WP-0034-T02 | done | — | workplans/KEY-WP-0034-account-recovery.md |
+| task | KEY-WP-0035-T01 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T02 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T03 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T04 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0035-T05 | done | — | workplans/KEY-WP-0035-optional-mfa.md |
+| task | KEY-WP-0036-T01 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0036-T02 | cancel | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0036-T03 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
+| task | KEY-WP-0037-T01 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T02 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T03 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0037-T04 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0038-T01 | done | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T02 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T03 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T04 | cancel | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0039-T01 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0039-T02 | wait | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0039-T03 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
+| task | KEY-WP-0040-T01 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0040-T02 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0041-T01 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| task | KEY-WP-0041-T02 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/owner-publication/publication-backup/originals.json

@@ -0,0 +1,10 @@
+[
+  {
+    "path": ".custodian-brief.md",
+    "index": "100644 f0bc1344d7e573e6a656ee7ce3f548d341dcd476 0\t.custodian-brief.md"
+  },
+  {
+    "path": "WORK-RECORDS.md",
+    "index": "100644 d86b29bbc480acfa6d12d5052039578d7d4e380c 0\tWORK-RECORDS.md"
+  }
+]

docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/apps-publication/consistency.json

@@ -0,0 +1,382 @@
+{
+  "repo_slug": "railiance-apps",
+  "repo_path": "/home/worsch/railiance-apps",
+  "source_revision": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo",
+      "file_path": ".repo-classification.yaml",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager missing: README.md: README.md is required for flavor project",
+      "file_path": "README.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['RAILIANCE-WP', 'RAPPS-WP']",
+      "file_path": "workplans/",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1: task id 'RAILIANCE-WP-0004-I01' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2: task id 'RAILIANCE-WP-0004-I02' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3: task id 'RAILIANCE-WP-0004-I03' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4: task id 'RAILIANCE-WP-0004-I04' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5: task id 'RAILIANCE-WP-0004-I05' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6: task id 'RAILIANCE-WP-0004-I06' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7: task id 'RAILIANCE-WP-0004-I07' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I01' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I02' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I03' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I04' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I05' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I06' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-31",
+      "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I07' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-33",
+      "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
+      "file_path": "WORK-RECORDS.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-39",
+      "message": "Wait task 'RAPPS-WP-0015-T04' in workplan 'RAPPS-WP-0015' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait",
+      "file_path": "workplans/RAPPS-WP-0015-coulomb-personal-content-release.md#RAPPS-WP-0015-T04",
+      "db_id": "",
+      "file_value": "wait",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'KEY-WP-0038' is not linked to State Hub",
+      "file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
+      "db_id": "",
+      "file_value": "KEY-WP-0038",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-39",
+      "message": "Human wait task 'RAPPS-WP-0016-T04' in workplan 'RAPPS-WP-0016' has needs_human: true without decision_id \u2014 unrouted human gate",
+      "file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md#RAPPS-WP-0016-T04",
+      "db_id": "",
+      "file_value": "needs_human: true",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'RPF-WP-0058' is not linked to State Hub",
+      "file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md",
+      "db_id": "",
+      "file_value": "RPF-WP-0058",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-20",
+      "message": "Workplan dependency target 'REUSE-WP-0025' is not linked to State Hub",
+      "file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md",
+      "db_id": "",
+      "file_value": "REUSE-WP-0025",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0006@retired-20260826' (id=1960b22b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "1960b22b-82ae-4b67-9fff-397bd38bdd65",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0005@retired-20260826' (id=685f1c18\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "685f1c18-33c0-400d-a2b1-e1dae0f27c3e",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0009@retired-20260826' (id=21c3fcdc\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "21c3fcdc-f014-4858-8028-0ac3038212b7",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0011@retired-20260826' (id=98cf42ae\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "98cf42ae-9b64-4736-97e1-bae325ded1f9",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0008@retired-20260826' (id=41b9deea\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "41b9deea-a935-4372-8916-b3981336f597",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0018@retired-20260826' (id=1b9af4e8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "1b9af4e8-7579-5141-837b-c736b85204a0",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0007@retired-20260826' (id=7da18dd8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "7da18dd8-76b9-4a70-b9d7-de541afc65c0",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0010@retired-20260826' (id=a4f301bb\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "a4f301bb-3f49-450a-8dbd-5cf6a16b8e0f",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RAIL-AP-WP-0001' uses prefix 'RAIL-AP-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260605-RAIL-AP-WP-0001-gitea-container-registry.md",
+      "db_id": "",
+      "file_value": "RAIL-AP-WP-0001",
+      "db_value": "RAPPS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RAILIANCE-WP-0002' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0002-vergabe-teilnahme-on-railiance01.md",
+      "db_id": "",
+      "file_value": "RAILIANCE-WP-0002",
+      "db_value": "RAPPS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RAILIANCE-WP-0004' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md",
+      "db_id": "",
+      "file_value": "RAILIANCE-WP-0004",
+      "db_value": "RAPPS-WP",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 20/20",
+    "C-17 cleared: pushed 1 backlogged commit(s)",
+    "C-33 fixed: regenerated WORK-RECORDS.md",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 28,
+    "info": 8
+  },
+  "result": "warn"
+}