<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — user-engine

**Domain:** communication  
**Last synced:** 2026-10-09 13:53 UTC  
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

## Active Workstreams

### User account journeys and recovery
Progress: 1/3 done  |  workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b`

**Open tasks:**
- ! Connect authoritative application access  `5d1bf977`
  *(wait: Blocked on the provider-owned catalogue/admission and scoped grant/revocation contract from USER-WP-0026-T03.)*
- ! Complete optional OTP onboarding with provider evidence  `40e46e52`
  *(wait: Attended live acceptance of U05-U08 (enrollment, cancel, replace, lost-factor recovery, old-AAL1-session behavior) against the real provider factor before enabling live handoff; no stub acceptance.)*

### Clear account state and complete user, tenant-admin and platform-admin journeys
Progress: 4/6 done  |  workplan_id: `455300ca-ec1e-569e-a584-a8dcda2595cf`

**Open tasks:**
- ! Complete provider OTP activation and recovery path  `9657abcb`
  *(wait: Attended live acceptance of U05-U08/P04-P06 against the real provider factor (enrollment, cancellation, replacement, recovery, fresh login, privileged portal policy); the net-kingdom-privacyidea-admin-token route is still resolvable:false because railiance-platform has not published its OpenBao path/field/expiry contract.)*
- ! Validate all journeys across roles and applications  `550886ca`
  *(wait: Full journey matrix needs authoritative application access (USER-WP-0026-T03), factor recovery (T04) and preserves VERGABE-WP-0019 real-user acceptance.)*

### Account recovery and visible identity and access
Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`

**Open tasks:**
- ! Discover workload access from authoritative application records  `95e9a6d4`
  *(wait: Needs a provider-owned workload catalogue and application access decisions for the signed-in identity; the membership store cannot represent the allow list.)*

### Onboarding handoff findings from the 2026-09-23 operator run
Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`

**Open tasks:**
- ! Deliver the setup link to the recipient  `fae614ba`
  *(wait: Needs the operator-owned governed transactional mail lane (email-connect plus the OpenBao delivery token).)*

### Read-only account authority for Hub integration
Progress: 2/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`

**Open tasks:**
- ! Authenticated workload transport and private acceptance  `c5d67725`
  *(wait: T02 delivered empty no-grant custody integration; real independently authenticated Hub caller credential admission and withdrawal/outage/private integration acceptance remain with state-hub (original f3bcc516; renewed request 350c3e12-284c-43a7-9ab1-116df8bcc007). Hub repository registration is not caller admission.)*

---
## MCP Orientation (when available)

If the state-hub MCP server is reachable, call:
`get_domain_summary("communication")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.