Prepare staged index generation and reconcile implementation paths

2026-10-19 11:30:16 +02:00 · 2026-10-19 11:30:16 +02:00 · fd4a3ba00e
commit fd4a3ba00e
parent 73801af1c8
9 changed files with 576 additions and 16 deletions
--- a/7
+++ b/7
@ -230,3 +230,10 @@ artifact-adr008:
 	  --output build/adr-008.html \
 	  --title "Tenancy Posture" \
 	  --subtitle "A framework for describing, holding and improving multi-tenancy — including where we are not there yet."
+
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records: ## Regenerate and stage index from staged sources; preserve unstaged edits
+	python3 scripts/generate_staged_work_records.py --repo . --repo-slug the-custodian
+
+generated-work-records-check: ## Check staged index without committing, pushing or changing files
+	python3 scripts/generate_staged_work_records.py --repo . --repo-slug the-custodian --check
--- a/SCOPE.md
+++ b/SCOPE.md
@ -1,7 +1,7 @@
 ---
 domain: custodian
 repo: the-custodian
-updated: "2026-08-23"
+updated: "2026-10-19"
 ---

 # SCOPE
@ -87,14 +87,15 @@ their own repositories and are referenced here only as integration pointers.

 ## Current State

- Status: **maintenance; three open workplans, none implementable here as of
-  2026-10-09.** `CUST-WP-0071` (workload sizing) waits on RAPPS-WP-0014-T03;
-  `CUST-WP-0073` (agent credential separation) waits on GLAS-WP-0012;
-  `CUST-WP-0076` is a residual awaiting the operator's provisioning-window
-  choice (decision `62aa95e4`). `CUST-WP-0064` through `CUST-WP-0068` and
-  `CUST-WP-0074`, `-0075`, `-0077` are finished. The active registry is 120
-  classified repositories; `make classification-check` is the convergence gate.
-  Residual `CUST-IN-0015` tracks a later SBOM catch-up `no-checkout` regression.
+- Status: active coordination and source tooling. `CUST-WP-0071` retains
+  representative pilot acceptance, allocation review and weekly execution;
+  `CUST-WP-0073` retains actual interactive credential isolation and its
+  documentation; `CUST-WP-0079` retains schedule activation, policy publication,
+  fleet history acceptance and attended actions. Consult their task blocks for
+  current gates. `CUST-WP-0076` and `CUST-WP-0080` are finished; later architecture
+  and hardening work is tracked in `CUST-WP-0081` and `CUST-WP-0082`.
+  Source preparation and owner integration can proceed independently of attended
+  acceptance; a blocked acceptance gate does not imply absent implementation.
 - Cross-domain work driven from here but owned elsewhere: forge closure
  (prj-forgejo-org-refactor `ORGREF-WP-0002`; decision record
  `decisions/forge-visibility-policy.md`) and the SecurityCaseType model
@ -200,6 +201,46 @@ description: Durable, reviewable working notes and immutable episodic logs prese
 keywords: [memory, provenance, episodic, continuity, decisions]
 ```

+```capability
+type: tool
+title: Deterministic security work reporting and checkpointed delivery
+description: scripts/security_flow_report.py classifies repo-backed tasks with dependency and human gates; scripts/security_flow_daily.py synchronizes recorded decisions and delivers changed actionable reports with recipient checkpoints. Dry-run by default; durable schedule acceptance remains CUST-WP-0079-T03.
+keywords: [security, workplans, dependencies, reports, checkpoints, scheduling]
+```
+
+```capability
+type: tool
+title: Generated-only commit guard
+description: scripts/check_generated_only_commit.py checks staged changes or commit ranges; make generated-commit-hook preserves existing hook routing. Local enforcement and tests exist; the 2026-10-12 through 2026-10-19 local history audit found no generated-only commits across the 15-repo security estate. Fleet generator adoption remains a CUST-WP-0079-T05 acceptance obligation.
+keywords: [git, generated, hooks, work-records, validation]
+```
+
+```capability
+type: tool
+title: Staged work-record index generation
+description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; shared-hook activation and fleet adoption are not established. See docs/staged-work-record-generation.md.
+keywords: [git, generated, work-records, staged-sources, validation]
+```
+
+```capability
+type: tool
+title: Workload allocation reconciliation
+description: scripts/reconcile_railiance_allocation.py joins railiance-cluster observations with namespace ownership and State Hub release preflight. Supports retained observation input; distinguishes reservation headroom from demand. Representative pilot sizing and unattended weekly assessment remain unverified.
+keywords: [capacity, allocation, telemetry, ownership, sizing]
+```
+
+```capability
+type: tool
+title: Agent supervision evidence summary
+description: scripts/summarize_agent_supervision.py reports acceptance and verified execution outcomes from an existing identified agent record. Descriptive only; grants no authority, runtime isolation or autopilot promotion.
+keywords: [agents, supervision, evidence, approvals]
+```
+
+These local discovery descriptions are not publication grants. The federated
+`registry/indexes/capabilities.yaml` deliberately exposes only generic runtime
+and repository classification tooling. Confidential canon, memory, operational
+records and estate-specific execution configuration stay outside that boundary.
+
 ---

 ## Notes
@ -207,8 +248,8 @@ keywords: [memory, provenance, episodic, continuity, decisions]
 - This repo intentionally avoids reabsorbing runtime code. If a subsystem grows a
  runtime, tests, and a deployment surface, it should move to its own repo and
  report back through the State Hub and workplans (see `INTENT.md` → design values).
- After any workplan change, run `cd /home/worsch/state-hub && make
-  fix-consistency REPO=the-custodian` to keep the dashboard accurate.
+- After any workplan change, run `statehub fix-consistency` to keep the
+  dashboard accurate; inspect its generated changes and publication behavior.
 - `README.md` still references "seven project domains" / "six domain charters" —
  stale relative to the live 14-domain list; treat `list_domains()` as authoritative.
 - Prior SCOPE.md (stale, conflated this repo with the State Hub service) is
--- a/docs/evidence/2026-10-19-security-flow-week-history.json
+++ b/docs/evidence/2026-10-19-security-flow-week-history.json
@ -0,0 +1,105 @@
+{
+  "window_start": "2026-10-12T00:00:00+02:00",
+  "window_end": "2026-10-19T00:00:00+02:00",
+  "scope": "locally reachable history at observed HEAD; no remote fetch or runtime observation",
+  "classifier": "scripts/check_generated_only_commit.py:standalone",
+  "git_commands": [
+    "git log --since=<window_start> --until=<window_end> --format=%H",
+    "git diff-tree --root --no-commit-id -r --name-only <commit>"
+  ],
+  "commit_count": 498,
+  "generated_only_count": 0,
+  "repos": [
+    {
+      "repo": "the-custodian",
+      "commit_count": 155,
+      "generated_only": [],
+      "observed_head": "73801af1c8866760f4ad097ae958dd5380183077"
+    },
+    {
+      "repo": "net-kingdom",
+      "commit_count": 134,
+      "generated_only": [],
+      "observed_head": "b99e396283c5f18f6f990e0536852e816d561d91"
+    },
+    {
+      "repo": "railiance-platform",
+      "commit_count": 82,
+      "generated_only": [],
+      "observed_head": "79fbb4bdb5beb6c908e11691f8a4fd91ca9d151d"
+    },
+    {
+      "repo": "activity-core",
+      "commit_count": 4,
+      "generated_only": [],
+      "observed_head": "70ff24197a2d8d3dc94abc0740210190f75fc351"
+    },
+    {
+      "repo": "access-engine",
+      "commit_count": 10,
+      "generated_only": [],
+      "observed_head": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3"
+    },
+    {
+      "repo": "secrets-engine",
+      "commit_count": 13,
+      "generated_only": [],
+      "observed_head": "691dc742362eeec45d5bd32d2b468f31a959748e"
+    },
+    {
+      "repo": "ops-mason",
+      "commit_count": 37,
+      "generated_only": [],
+      "observed_head": "eb3d7047adcdc7e5630282697a2955993a9bae22"
+    },
+    {
+      "repo": "ops-warden",
+      "commit_count": 25,
+      "generated_only": [],
+      "observed_head": "08c098e64a9afd89e43f65436782ed2bb69cdfbd"
+    },
+    {
+      "repo": "key-cape",
+      "commit_count": 20,
+      "generated_only": [],
+      "observed_head": "e2c5a947829568baf837543a6708fd0c3f6a863b"
+    },
+    {
+      "repo": "user-engine",
+      "commit_count": 8,
+      "generated_only": [],
+      "observed_head": "9557d6f867fe03c546aa26655f84b4192109981d"
+    },
+    {
+      "repo": "tenant-engine",
+      "commit_count": 1,
+      "generated_only": [],
+      "observed_head": "79a61905957bd78d3f4c93da42d7034ad3e3c8de"
+    },
+    {
+      "repo": "gate-house",
+      "commit_count": 1,
+      "generated_only": [],
+      "observed_head": "ab1a299674679ccfefa8df84b877614ac44c9d38"
+    },
+    {
+      "repo": "kings-guard",
+      "commit_count": 6,
+      "generated_only": [],
+      "observed_head": "09ada1d98100d4f3c6aa6e94e8ec5f41b7465c3b"
+    },
+    {
+      "repo": "policy-nexus",
+      "commit_count": 1,
+      "generated_only": [],
+      "observed_head": "19b65d5b31336a7cab2e7a2a944b0167d1d77d56"
+    },
+    {
+      "repo": "rapp-policy-nexus",
+      "commit_count": 1,
+      "generated_only": [],
+      "observed_head": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3"
+    }
+  ],
+  "generator_adoption_proven": false
+}
--- a/docs/staged-work-record-generation.md
+++ b/docs/staged-work-record-generation.md
@ -0,0 +1,42 @@
+# Staged work-record index generation
+
+CUST-WP-0079-T05 provides a local Make adapter to the existing State Hub
+work-record renderer. It generates `WORK-RECORDS.md` from staged Markdown blobs,
+not from unstaged worktree contents. It performs no hub calls, commit or push.
+
+In the Custodian checkout, stage the intended source changes, then run:
+
+```bash
+make generated-work-records
+make generated-work-records-check
+```
+
+The first command writes and stages only `WORK-RECORDS.md`; the second checks
+without writing. Both refuse an unstaged change to that generated file. Preserve
+or reconcile such changes explicitly before running generation. Unstaged source
+edits remain untouched. Unmerged entries and Markdown symlinks are rejected.
+
+Other repositories can adopt the same source adapter through their own reviewed
+Make target, supplying the canonical identity explicitly so renamed checkouts
+and worktrees produce the same index title:
+
+```bash
+python3 /home/worsch/the-custodian/scripts/generate_staged_work_records.py \
+  --repo /path/to/checkout --repo-slug canonical-repository-slug \
+  --renderer-root /home/worsch/state-hub
+```
+
+`--renderer-root` selects the owner checkout containing
+`scripts/consistency_check.py`. Its renderer and canonical kind registry must be
+available. Each rendering uses a fresh Python process so imports cannot silently
+reuse a different owner checkout. The adapter does not duplicate the parser or
+call the auto-publishing consistency CLI. It retains the owner's generated-file
+format, including its existing regeneration attribution.
+
+This implementation has not been activated in shared hooks or adopted across
+the fleet. A future reviewed pre-commit integration must run generation beside
+the existing generated-only guard and secret scan, retain their rejection
+behavior, and preserve unrelated hooks and changes. The existing guard still
+rejects generated-only commits. Source inventories and publication indexes
+retain their respective owner generators; this adapter generates only the
+work-record index. Fleet adoption remains an open CUST-WP-0079-T05 obligation.
--- a/scripts/generate_staged_work_records.py
+++ b/scripts/generate_staged_work_records.py
@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+"""Regenerate WORK-RECORDS.md from staged Markdown, preserving unstaged edits.
+
+Uses the existing State Hub renderer. No hub access, commit or push. Intended
+for a Make target invoked by pre-commit, before the unchanged generated guard.
+"""
+import argparse
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+
+
+INDEX = 'WORK-RECORDS.md'
+
+
+def git(repo, *args):
+    return subprocess.check_output(['git', '-C', str(repo), *args])
+
+
+def render(snapshot, slug, renderer_root):
+    # Isolate owner imports and their transitive modules for each explicit root.
+    # Repeated calls cannot accidentally reuse another checkout's cached module.
+    code = """
+import sys
+from pathlib import Path
+sys.path.insert(0, str(Path(sys.argv[1]).resolve() / 'scripts'))
+import consistency_check as owner
+if not owner._load_work_record_kind_registry():
+    raise ValueError('canonical work-record kind registry unavailable')
+content = (owner._generate_work_record_index(Path(sys.argv[2]), sys.argv[3])
+           or owner._work_record_index_document(sys.argv[3], []))
+sys.stdout.buffer.write(content.encode())
+"""
+    return subprocess.check_output([sys.executable, '-c', code,
+                                    str(renderer_root), str(snapshot), slug])
+
+
+def generate(repo, renderer_root, *, repo_slug, check=False):
+    if not re.fullmatch(r"[a-z0-9]+(?:-[a-z0-9]+)*", repo_slug):
+        raise ValueError("repo slug must be the canonical lowercase repository identifier")
+    repo = Path(git(repo, 'rev-parse', '--show-toplevel').decode().strip())
+    staged_entries = git(repo, 'ls-files', '--stage', '-z')
+    entries = []
+    for entry in staged_entries.split(b'\0'):
+        if not entry:
+            continue
+        metadata, path = entry.split(b'\t', 1)
+        mode, oid, stage = metadata.split()
+        if stage != b'0':
+            raise ValueError('unmerged index; resolve conflicts before generating')
+        path = path.decode()
+        if path.endswith('.md') and path != INDEX:
+            if mode not in (b'100644', b'100755'):
+                raise ValueError('refuse non-regular Markdown source: ' + path)
+            entries.append((path, oid.decode()))
+    destination = repo / INDEX
+    if destination.is_symlink():
+        raise ValueError('refuse redirected generated index')
+    indexed = subprocess.run(['git', '-C', str(repo), 'show', ':' + INDEX],
+                             capture_output=True)
+    previous = indexed.stdout if indexed.returncode == 0 else None
+    existing = destination.read_bytes() if destination.exists() else None
+    if existing != previous:
+        raise ValueError('unstaged WORK-RECORDS.md content; preserve or reconcile it first')
+    with tempfile.TemporaryDirectory(prefix='staged-work-records-') as directory:
+        snapshot = Path(directory)
+        for path, oid in entries:
+            target = snapshot / path
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(git(repo, 'cat-file', 'blob', oid))
+        content = render(snapshot, repo_slug, renderer_root)
+    if content == previous:
+        return False
+    if check:
+        raise ValueError('staged WORK-RECORDS.md is stale')
+    if staged_entries != git(repo, 'ls-files', '--stage', '-z'):
+        raise ValueError('Git index changed during rendering; retry')
+    if (destination.read_bytes() if destination.exists() else None) != existing:
+        raise ValueError('WORK-RECORDS.md changed during rendering; retry')
+    destination.write_bytes(content)
+    subprocess.run(['git', '-C', str(repo), 'add', '--', INDEX], check=True)
+    return True
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--repo', type=Path, default=Path.cwd())
+    parser.add_argument('--repo-slug', required=True,
+                        help='canonical repository identity, independent of checkout path')
+    parser.add_argument('--renderer-root', type=Path,
+                        default=Path(__file__).resolve().parents[2] / 'state-hub')
+    parser.add_argument('--check', action='store_true')
+    args = parser.parse_args()
+    try:
+        changed = generate(args.repo, args.renderer_root, repo_slug=args.repo_slug, check=args.check)
+    except (OSError, ValueError, subprocess.CalledProcessError, ImportError) as exc:
+        parser.exit(1, str(exc) + '\n')
+    print('staged work-record index regenerated' if changed else 'staged work-record index current')
+
+
+if __name__ == '__main__':
+    main()
--- a/tests/test_staged_work_records.py
+++ b/tests/test_staged_work_records.py
@ -0,0 +1,103 @@
+import importlib.util
+from pathlib import Path
+import subprocess
+from unittest.mock import patch
+
+import pytest
+
+SPEC = importlib.util.spec_from_file_location('staged_records', Path(__file__).parents[1] / 'scripts/generate_staged_work_records.py')
+module = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(module)
+
+
+def git(repo, *args):
+    return subprocess.check_output(['git', '-C', str(repo), *args])
+
+
+@pytest.fixture
+def repo(tmp_path):
+    git(tmp_path, 'init', '-q')
+    (tmp_path / 'workplans').mkdir()
+    (tmp_path / 'workplans/plan.md').write_text('staged source')
+    (tmp_path / module.INDEX).write_text('old index')
+    git(tmp_path, 'add', '.')
+    return tmp_path
+
+
+def renderer(snapshot, slug, root):
+    return (snapshot / 'workplans/plan.md').read_bytes() + b' rendered'
+
+
+def test_staged_source_is_used_and_unstaged_source_preserved(repo):
+    source = repo / 'workplans/plan.md'
+    source.write_text('unstaged user edits')
+    with patch.object(module, 'render', renderer):
+        assert module.generate(repo, '/unused', repo_slug='canonical-repo')
+    assert git(repo, 'show', ':WORK-RECORDS.md') == b'staged source rendered'
+    assert source.read_text() == 'unstaged user edits'
+    assert git(repo, 'show', ':workplans/plan.md') == b'staged source'
+
+
+def test_unstaged_generated_file_is_never_overwritten(repo):
+    (repo / module.INDEX).write_text('user index edits')
+    before = git(repo, 'ls-files', '--stage')
+    with pytest.raises(ValueError, match='unstaged WORK-RECORDS'):
+        module.generate(repo, '/unused', repo_slug='canonical-repo')
+    assert (repo / module.INDEX).read_text() == 'user index edits'
+    assert git(repo, 'ls-files', '--stage') == before
+
+
+def test_check_is_read_only_and_rerun_is_idempotent(repo):
+    with patch.object(module, 'render', renderer):
+        before = git(repo, 'ls-files', '--stage')
+        with pytest.raises(ValueError, match='is stale'):
+            module.generate(repo, '/unused', repo_slug='canonical-repo', check=True)
+        assert git(repo, 'ls-files', '--stage') == before
+        assert (repo / module.INDEX).read_text() == 'old index'
+        assert module.generate(repo, '/unused', repo_slug='canonical-repo')
+        assert not module.generate(repo, '/unused', repo_slug='canonical-repo')
+
+
+def test_markdown_symlink_is_rejected(repo):
+    (repo / 'redirect.md').symlink_to('/etc/passwd')
+    git(repo, 'add', 'redirect.md')
+    with pytest.raises(ValueError, match='non-regular Markdown'):
+        module.generate(repo, '/unused', repo_slug='canonical-repo')
+
+
+def test_removed_last_record_renders_empty_owner_document(repo):
+    owner_root = Path('/home/worsch/state-hub')
+    if not owner_root.exists():
+        pytest.skip('owner renderer checkout unavailable')
+    result = module.render(repo, 'example', owner_root)
+    assert b'# Work Records' in result
+    assert b'| Kind | ID | Status | Lane | Source |' in result
+
+
+def test_owner_renderer_reads_actual_staged_workplan(repo):
+    owner_root = Path('/home/worsch/state-hub')
+    if not owner_root.exists():
+        pytest.skip('owner renderer checkout unavailable')
+    source = repo / 'workplans/plan.md'
+    source.write_text('---\nid: TEST-WP-0001\nstatus: active\n---\n\n## Work\n\n```task\nid: TEST-WP-0001-T01\nstatus: todo\n```\n')
+    git(repo, 'add', 'workplans/plan.md')
+    source.write_text('unstaged replacement')
+    assert module.generate(repo, owner_root, repo_slug='canonical-repo')
+    generated = git(repo, 'show', ':WORK-RECORDS.md')
+    assert b'# Work Records \xe2\x80\x94 canonical-repo' in generated
+    assert repo.name.encode() not in generated
+    assert b'TEST-WP-0001-T01 | todo' in generated
+    assert b'TEST-WP-0001 | active' in generated
+    assert source.read_text() == 'unstaged replacement'
+
+
+def test_explicit_renderer_roots_do_not_share_import_cache(tmp_path):
+    for label in ('first', 'second'):
+        root = tmp_path / label
+        (root / 'scripts').mkdir(parents=True)
+        (root / 'scripts/consistency_check.py').write_text(
+            'def _load_work_record_kind_registry(): return [1]\n'
+            f'def _generate_work_record_index(snapshot, slug): return {label!r} + slug\n'
+            'def _work_record_index_document(slug, rows): return "unused"\n'
+        )
+        assert module.render(tmp_path, 'canonical-repo', root) == (label + 'canonical-repo').encode()
--- a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md
+++ b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md
@ -9,7 +9,7 @@ flavor: planning
 owner: the-custodian
 topic_slug: custodian
 created: "2026-09-11"
-updated: "2026-10-04"
+updated: "2026-10-19"
 related: [STATE-WP-0091, RCLUSTER-WP-0014, RESOURCE-WP-0003, RAPP-TELEMETRY-WP-0001, RAIL-FAB-WP-0028, RAPPS-WP-0014, VERGABE-WP-0019, HFACT-WP-0001]
 state_hub_workstream_id: "2249bddb-7524-5add-bd5c-c4163a6ca0f3"
 ---
@ -295,3 +295,60 @@ describes preparation, not the current task status.
 The foreign acceptance is observed through the review's RAPPS coordination case;
 no owner task is reassigned or patched. No load or live characterization was
 performed. Historical telemetry does not establish current spare capacity.
+
+
+## Implementation preparation review — 2026-10-19
+
+The October 19 source audit still finds RAPPS-WP-0014-T03 waiting on the
+attended two-user/document workflow (decision
+`d06307e5-2737-461a-a2f4-a12c3b492a9a`). VERGABE-WP-0019 remains blocked.
+No new representative measurements, acceptance or production allocation changes
+are claimed. T02–T05 retain their current statuses and acceptance criteria.
+
+The September statement that no further step is implementable applies to
+acceptance, not to preparation. Prepare the remaining work through these
+existing provider interfaces rather than building replacement services:
+
+| Consumer task | Existing reusable surface | Remaining implementation/evidence |
+| --- | --- | --- |
+| T02 | RAPPS-WP-0014-T03 synthetic workflow and VERGABE-WP-0019 release/tenant assumptions; `rapp-telemetry` private Prometheus | Add timestamped operation durations/errors and separate document timing to the existing attended run; correlate the exact window with CPU, memory, throttling and incremental database measurements. Do not treat the full backup/restore gate as a prerequisite for preparing the measurement capture. |
+| T03 | `railiance-cluster`: `make cluster-observe`; `railiance-forge`: `make forge-observe REMOTE=railiance01`; Custodian `scripts/reconcile_railiance_allocation.py` | Refresh the observations together, join current namespace ownership, and review Forgejo/runner concurrency plus zero-request workloads with their owners. Completed RCLUSTER-WP-0014 and RFORGE-WP-0002 supply collectors, not current demand acceptance. |
+| T03/T04 | `resource-control`: `make portfolio-report`, `make optimization CASE=...`; current resource inventory; STATE-WP-0091 release preflight | Prepare the budget and explicit keep/change decisions, preserving host/cluster deduplication, maintenance and release surge margin. Only apply reviewed decisions; retain useful-operation verification even for a keep decision. |
+| T05 | `activity-core/activity-definitions/`, deterministic instruction/report path, Temporal cron timezone/misfire support, `ops_runs` retries and `/ops/automations/status` | Prepare one disabled weekly definition and the narrow assessment adapter/retained report contract. Reuse existing owner work records for recommendations. Enable only after T04 and executor-owner acceptance; verify an unattended run, acknowledgment and missed-run recovery before completion. |
+
+T05's retained report must preserve the exact observation interval, collector
+and query revisions, workload identity/owner, CPU/memory p95 and peak, requests
+and limits, activity/latency/errors/throttling/restarts, pending demand, release
+margin, coverage/freshness, previous-period comparison and recommendation
+confidence. Missing measurements remain explicit unknowns. Recommendation
+identity must remain stable across retries and repeated weeks so the same
+outstanding owner task is updated instead of recreated. The existing activity
+execution receipt is not by itself a workload-owner acknowledgment.
+
+Discovery source maintenance completed on October 19: cluster's obsolete
+no-monitoring statement now points to rapp-telemetry's private package evidence;
+railiance-telemetry separates its signal integration/delivery gate from that
+runtime. All five sources now expose fenced observation/package/portfolio
+capabilities with private boundaries and explicit limitations. Commits:
+railiance-cluster `07ce43f`, resource-control `1be1435`, railiance-forge `181adb6`,
+rapp-telemetry `2b2c6f0`, railiance-telemetry `95a862b`. Capability YAML parsing
+and whitespace checks passed. These source commits alone do not establish
+reuse-surface ingestion or live runtime verification.
+
+Read-only repository cleanliness inspection found staged generated brief changes
+in railiance-apps and railiance-cluster, plus generated WORK-RECORDS.md changes
+in railiance-cluster and railiance-forge. The other inspected providers
+(vergabe-teilnahme, resource-control, rapp-telemetry, railiance-telemetry and
+activity-core) were initially clean. The cluster index adds existing
+RCLUSTER-WP-0017 signer/storage work; the forge index adds existing
+FORGE-WP-0006–0009 records. These are not sizing implementation and remain
+preserved for owner review. The source corrections above were committed using
+scoped paths without including those pre-existing changes.
+
+Package verification: rapp-telemetry `make check` passed for 93 privately rendered
+resources. `make family-check` found the unrelated missing
+`rapp-forgejo/declarations/rapp.yaml` (18 declarations, one error), so fleet family
+validation is not green. The required `rmgr sync --path . --push` returned an
+applied primary receipt with expected and derived commit both
+`2b2c6f08005905a50dd394b137c4c010251b13ba`. This is repository projection evidence,
+not live telemetry or reuse-surface ingestion proof.
--- a/workplans/CUST-WP-0073-agent-credential-separation.md
+++ b/workplans/CUST-WP-0073-agent-credential-separation.md
@ -9,7 +9,7 @@ owner: the-custodian
 topic_slug: custodian
 flavor: implementation
 created: "2026-09-24"
-updated: "2026-10-04"
+updated: "2026-10-19"
 related:
  - KEY-WP-0033
  - RPF-WP-0044
@ -307,3 +307,52 @@ supervision guidance is complete; another local mode label cannot advance T02.
 T05 retains decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa` and the founder's
 three original reopening triggers. This review grants no credential cutover,
 rotation or autopilot authority.
+
+## Implementation path review — 2026-10-19
+
+The September/October dependency history above is historical. Reuse the existing
+Glas/sand-boxer/rein chain rather than introducing another supervisor service.
+Glas `SCOPE.md` was reconciled with its actual six-profile catalog and dated
+owner returns at `9ddf99c`: no profile is ready; local 1.1.1 and FI research are
+unverified. The native credential lanes were activated and revoked in September;
+their old absence is not the remaining implementation problem.
+
+The newer Custodian native-runtime receipt is authoritative over the October 16
+Glas narrative: `docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json`
+records installed artifact `f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d`
+and verified complete digest on Railiance. Offline rehearsal failed with
+`phase_receipt_unavailable`; process supervision verified quiescence after
+`leader_left_descendants`. That failed revision is retained. The subsequent
+`docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json`
+records `installed_runtime_offline_rehearsal_verified`: rein, Glas and Claude
+startup all return zero, post-rehearsal full digest matches, durable receipt
+precedes cleanup, and no live/waitable descendants remain. Zero model calls and
+no credential/owner-configuration reads are explicit. Offline startup is done;
+actual interactive assignment admission and privileged-path acceptance remain.
+
+Efficient remaining sequence within T02/T04:
+
+1. Reconcile the existing HARNESS-WP-0008-T07 owner return with this installed
+   artifact and successful revision-3 offline rehearsal (preserving revision-2
+   failure), then complete owner-admitted runtime/provider acceptance under the
+   existing exact approval requirements. Do not reinstall or rebuild older
+   candidates, or repeat the already completed offline rehearsal.
+2. In parallel prepare restricted identity/RBAC, k3s mode-600 configuration and
+   host principal/SSH issuance changes with their existing owners. Preparation
+   does not need to wait for the model run; applying the combined cutover does
+   require the exact reviewed proposal and privileged-path approval.
+3. Admit the actual Custodian interactive assignment, including external tool
+   paths. Prove Secret/exec denial, non-system:masters identity, denial of old
+   admin SSH/sudo/socket/GitOps/credential paths, sanitized approved execution
+   and refusal of changed/unapproved actions. A disposable sandbox or successful
+   model task cannot replace these checks.
+4. Document only that accepted execution revision in T04 and retain the explicit
+   Codex/Grok guard availability statement. No equivalent hook was established
+   by this review. T05 remains the original founder-triggered deferral.
+
+Source cleanup inspection found only generated brief/work-record changes in
+Glas, platform, infra and warden, with sand-boxer, rein-aharness, rein-openweights
+and enablement clean. Glas's generated change matches GLAS-WP-0016-T02 already
+done in its source workplan; use the owning generator workflow to commit those
+projections. No privileged change, runtime retry, rotation or autonomy grant
+was performed by this review.
--- a/workplans/CUST-WP-0079-deterministic-security-flow.md
+++ b/workplans/CUST-WP-0079-deterministic-security-flow.md
@ -8,7 +8,7 @@ status: blocked
 owner: claude-code
 topic_slug: custodian
 created: "2026-10-11"
-updated: "2026-10-13"
+updated: "2026-10-19"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "ab288f92-d364-5c24-9362-aee451f266c3"
@ -115,7 +115,7 @@ Canon source written 2026-10-11: `canon/standards/build-mode-change-authorizatio
 id: CUST-WP-0079-T05
 status: wait
 blocked_on: message-from:repo-manager
-blocking_reason: "Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed."
+blocking_reason: "Local/shared guards are implemented and the 2026-10-12 to 2026-10-19 local history audit found zero generated-only commits across 15 security repos (498 commits). Fleet generator adoption remains unverified; shared hooks reject but do not regenerate indexes."
 priority: medium
 state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
 ```
@ -185,7 +185,7 @@ closeout does not resume it or claim native estate completion.
 id: CUST-WP-0079-T06
 status: wait
 needs_human: true
-blocking_reason: "Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login."
+blocking_reason: "Owner source rechecked 2026-10-19: RPF-WP-0044-T08 is done and KEY-WP-0040-T01 preview is done. Remaining attended acts are USER-WP-0026-T03 positive readback, USER-WP-0028-T03 U08 recovery, and RPF-WP-0044-T04 OpenBao OIDC/MFA login; completed preview does not authorize factor mutation."
 priority: high
 state_hub_task_id: "e3da807f-9a6e-513f-82dc-3714a489e7bf"
 ```
@ -207,3 +207,55 @@ Completed 2026-10-11: the renewed critical-path goal is active in thread
 execution. Work resumed from READY/UNBLOCKED, with three workers pinned to
 eligible workplans and the accepted build-mode authorization in force. This
 closes re-engagement only, not the live critical-path goal.
+
+## Current owner-source audit — 2026-10-19
+
+Activity Core source remains disabled (`daily-security-flow`, ACTIVITY-WP-0047
+T02/T03 wait), so neither checked-in scheduling nor clean source establishes an
+unassisted fire. Policy Nexus PNEX-WP-0006 remains blocked for founder-batch
+publication and its source-inventory gate; its eight guardrail tests pass.
+No privileged activation or policy publication was attempted.
+
+The fixed seven-day local Git window `[2026-10-12T00:00:00+02:00,
+2026-10-19T00:00:00+02:00]` contains 498 commits across all 15 repositories in
+`security_flow_report.DEFAULT_REPOS`. Applying the existing generated-only
+classifier to each commit found zero standalone generated-only commits.
+The receipt `docs/evidence/2026-10-19-security-flow-week-history.json` records
+repository HEADs and counts. This proves the observed local history window;
+it does not prove unobserved remote branches or fleet generator adoption.
+The shared repo-manager pre-commit hook rejects generated-only commits and
+scans staged secrets, but does not regenerate indexes. T05 therefore remains
+open for actual Make/hook or Forgejo generator adoption. Reuse the existing
+State Hub `scripts/consistency_check.py` work-record rendering functions rather
+than the auto-committing consistency CLI inside a hook; any integration must
+preserve unstaged edits and generate from the staged source snapshot.
+
+Scope discovery is now explicit and the three relevant owner checkouts are
+clean after source-only commits: policy-nexus `19b65d5` adds SCOPE and links it
+from its existing capability declaration; repo-manager `027b54e` documents
+sync, shared-hook boundaries and the missing generator adoption; activity-core
+`70ff241` documents the disabled fixed-command consumer and execution boundary.
+These are source capabilities, not runtime publication or authorization claims.
+
+T06's stale blockers were corrected from owner workplans: the coulombcore check
+was already complete, and KeyCape's attended TOTP preview completed October 17.
+Actual U08 recovery remains with USER-WP-0028-T03; a successful preview is not
+factor-disable/re-enrollment acceptance.
+
+T05 preparation now includes `scripts/generate_staged_work_records.py` and
+`make generated-work-records` / `make generated-work-records-check`. The adapter
+reuses the State Hub renderer against staged Markdown blobs, refuses conflicts,
+symlink sources and unstaged generated-file edits, and stages only the generated
+index. It never invokes the consistency CLI, hub, commit or push. Seven regression
+tests cover actual owner rendering, staged-versus-unstaged source isolation,
+generated-file preservation, read-only checking, idempotency and symlink refusal;
+these and the existing generated guard tests pass (ten tests). Shared-hook
+activation and fleet Make target adoption are still outstanding; the adapter
+alone is not evidence that repository indexes are generated during commits.
+
+Review refinement: generation requires `--repo-slug`, so worktrees and renamed
+checkouts retain canonical identity. Each explicit renderer checkout is loaded
+in a fresh subprocess, preventing cross-checkout module-cache reuse. Tests prove
+both boundaries. Usage and adoption limitations are documented in
+`docs/staged-work-record-generation.md` and the local SCOPE capability; no shared
+hook routing was changed.