build: keep generated orientation brief local and untracked

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

.custodian-brief.md

@@ -1,65 +0,0 @@
-<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
-# Custodian Brief — user-engine
-
-**Domain:** communication  
-**Last synced:** 2026-10-15 03:24 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Runtime image OS-package hardening for RISK-F-0016
-Progress: 0/1 done  |  workplan_id: `5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0`
-
-**Open tasks:**
-- · Remove or replace unfixed-HIGH OS packages in the runtime image  `59584b44`
-
-### User account journeys and recovery
-Progress: 1/3 done  |  workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b`
-
-**Open tasks:**
-- ! Connect authoritative application access  `5d1bf977`
-  *(wait: U09 reuses USER-WP-0026-T03 actual signed-in readback acceptance. T05 separately needs selection of the exact authoritative mutation fact and owner, then scoped mutation/revocation acceptance. Access readback delivers no generic grant API and FLEX-WP-0035 remains finished.)*
-- ! Complete optional OTP onboarding with provider evidence  `40e46e52`
-  *(wait: U05-U07 accepted in the attended run of 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md). U08 blocked by the recovery-preview defect KEY-WP-0040-T01; re-run steps 6.3 onwards after the fix with platform-root as operator. Also fix the vague 'sign-in service's recovery instructions' wording on /security (F3).)*
-
-### Clear account state and complete user, tenant-admin and platform-admin journeys
-Progress: 4/6 done  |  workplan_id: `455300ca-ec1e-569e-a584-a8dcda2595cf`
-
-**Open tasks:**
-- ! Complete provider OTP activation and recovery path  `9657abcb`
-  *(wait: U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01.)*
-- ! Validate all journeys across roles and applications  `550886ca`
-  *(wait: Full journey matrix needs authoritative application access (USER-WP-0026-T03), factor recovery (T04) and preserves VERGABE-WP-0019 real-user acceptance.)*
-
-### Account recovery and visible identity and access
-Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`
-
-**Open tasks:**
-- ! Discover workload access from authoritative application records  `95e9a6d4`
-  *(wait: Signed-in readback live and correct for the deny path (tegwick: Informed Decision - Not available, founder-confirmed correct; docs/evidence/2026-10-11-signed-in-application-readback.md). Remaining: attended positive check with a net-kingdom-admins account (expect Available), then catalogue-management restoration before customers (FLEX-IN-0003).)*
-
-### Onboarding handoff findings from the 2026-09-23 operator run
-Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`
-
-**Open tasks:**
-- ! Deliver the setup link to the recipient  `fae614ba`
-  *(wait: Existing mail service lacks an admitted provider password-setup template and recipient-bound opaque issuer handoff. EMAIL-IN-0001 and NET-IN-0005 request exact owner implementation records; no new founder choice or credential request.)*
-
-### Read-only account authority for Hub integration
-Progress: 2/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
-
-**Open tasks:**
-- ! Authenticated workload transport and private acceptance  `c5d67725`
-  *(wait: T02 delivered empty no-grant custody integration; real independently authenticated Hub caller credential admission and withdrawal/outage/private integration acceptance remain with state-hub (original f3bcc516; renewed request 350c3e12-284c-43a7-9ab1-116df8bcc007). Hub repository registration is not caller admission.)*
-
-## Inbox Hygiene
-
-**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("communication")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.

.gitignore

@@ -176,3 +176,6 @@ cython_debug/
 # PyPI configuration file
 .pypirc
 
+
+# Generated workstation orientation; keep local, regenerate from State Hub.
+/.custodian-brief.md

SCOPE.md

@@ -213,3 +213,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards
 and exact-scope secret scans remain in place. This is repository maintenance,
 not a runtime service, authorization decision, deployment or publication.
 Other index generators and hub-derived briefs retain their owner boundaries.
+
+
+## Local orientation brief
+
+`.custodian-brief.md` is a generated local orientation snapshot. It remains on
+disk for offline use and is root-ignored rather than versioned. Regenerate it
+with the State Hub brief renderer; workplans and other authored repository
+records remain authoritative. Brief refreshes must not create Git commits.