.custodian-brief.md

@@ -2,19 +2,20 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-07-29 22:39 UTC  
+**Last synced:** 2026-07-29 22:37 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Production self-service and user administration portal
-Progress: 4/8 done  |  workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519`
+Progress: 3/8 done  |  workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519`
 
 **Open tasks:**
 - ! T06 - Security, accessibility, and workflow conformance  `39dc383c`
 - ! T08 - Closure and next-stage handoff  `ecbdeef3`
 - ► T03 - Implement self-service login and registration UX  `45ed1485`
 - ► T04 - Implement tenant-admin and platform-admin UX  `16555b68`
+- ► T05 - Add production persistence and operability  `65ff5c96`
 
 ## Inbox Hygiene
 

workplans/USER-WP-0020-self-service-and-user-administration-portal.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-30"
+updated: "2026-07-28"
 depends_on:
   - USER-WP-0014
   - USER-WP-0015
@@ -54,7 +54,7 @@ metadata for that later stage.
 
 ```task
 id: USER-WP-0020-T02
-status: done
+status: progress
 priority: high
 state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
 ```
@@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain.
 
 ```task
 id: USER-WP-0020-T05
-status: done
+status: progress
 priority: high
 state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
 ```
@@ -162,14 +162,10 @@ and rollback/roll-forward no longer depends on containerd retaining local
 tags. An age-encrypted user-engine Postgres dump was uploaded through the
 established activity-core offsite lane with plaintext cleanup.
 
-2026-07-30 completion: the approved ops-mason plan moved the portal edge
-marker and provisioner service token into one exact OpenBao workload path,
-delivered through separate bounded AppRoles and namespace-restricted
-ExternalSecret stores. A coordinated rotation converged all three derived
-Secrets before restarting the portal and provisioner, and both Deployments
-returned Ready. Exact-path access succeeds, sibling-path access is denied,
-the derived client/server tokens match, and a post-rotation disposable
-identity reconciliation passed. No secret value entered recorded evidence.
+The remaining T05 item is migration of the portal edge marker and provisioner
+service token from bootstrap Kubernetes Secrets into an OpenBao-owned,
+ExternalSecret-delivered, rotatable lane. This requires the ops-mason
+executive approval gate for new secret custody.
 
 ## T06 - Security, accessibility, and workflow conformance