chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-10-04:
  - update .custodian-brief.md for whitehat-security

Assistant: grok
Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — whitehat-security
 
 **Domain:** infotech  
-**Last synced:** 2026-10-04 09:18 UTC  
+**Last synced:** 2026-10-04 09:37 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,29 +12,29 @@ Progress: 0/1 done  |  workplan_id: `94b71ba3-998d-5166-9730-6beb5f595923`
 
 **Open tasks:**
 - ! T01 — Live ASM under a new engagement  `1faabcb7`
-  *(wait: A surface owner must name, for one Canon test_id, the component revision, identities, window, and technique. T-06 still needs approval-engine and a consuming PEP. secrets-engine 4b4d556 is not that surface. One owner return admits only that test_id, and only after a complete engagement and plane admission.)*
+  *(wait: Guessed first test is T-06 on approval-engine image sha256:251941a5, source be1a388a, not checkout HEAD 1044a5f. Routes are claim and consume. The identity class is service, client secrets-engine-approval. No consuming PEP exists, and window, abort contact, and engagement id are still unapproved. secrets-engine approval_consume stays the in-process module. See engagements/2026-10-04-guessed-live-inputs.md.)*
 
 ### Authorized live residuals after WHITEHAT-WP-0001
 Progress: 0/3 done  |  workplan_id: `fe26f070-70ca-55ba-92b3-3378929ba90f`
 
 **Open tasks:**
 - ! T01 — Live E3 against a runtime-safe surface  `ed82ecb5`
-  *(wait: rapp-postgres must name a database whose ordinary runtime identity can read the conformance view without BYPASSRLS, superuser, or owner privilege, and a complete engagement must name that database, window, rate ceiling, abort contact, and finding destination.)*
+  *(wait: Guessed 2026-10-04 from rapp-postgres 11c1d489: database isolation_probe on platform-pg, view isolation_probe.rls_conformance, runtime role isolation_probe_app is NOBYPASSRLS and NOLOGIN, and SELECT is still granted only to isolation_probe_migrate. A human must approve that one grant and a short-lived login member, then a complete engagement must name the window, rate ceiling, abort contact, and finding destination. The guess is not approval. See engagements/2026-10-04-guessed-live-inputs.md.)*
 - ! T02 — Live P1/P2 against a bounded substrate window  `f226b8e1`
-  *(wait: An operator must approve a substrate window naming the aggressor consumer, allowance, concurrency and resource ceilings, service classes, headroom threshold, and abort thresholds. No repository has published that window.)*
+  *(wait: No approved substrate window exists. The 2026-10-04 guess leaves the aggressor, probe allowance, headroom threshold, and abort numbers unknown rather than inventing them. rapp-postgres ADR-0004's 14-connection quota and four-consumer cell are admission estimates, not a probe allowance. An operator must still approve the window. See engagements/2026-10-04-guessed-live-inputs.md.)*
 - ! T03 — Remaining E2 under new engagement IDs  `414a7f68`
-  *(wait: access-engine must confirm a tenant-A identity with no tenant-B authority for the flex-auth target, or audit-core must approve a later run under a new engagement ID. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal.)*
+  *(wait: access-engine 257a83e9 still has no tenant-A identity with no tenant-B authority. The closest fixture, cross-tenant-deny, does not qualify and is not the engagement identity. audit-core 28b567e does not mint a new engagement id. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal. See engagements/2026-10-04-guessed-live-inputs.md.)*
 
 ### Classify I and A, calibrate V observations, and name the live E4, R4, and V requirements
 Progress: 2/5 done  |  workplan_id: `b37d8173-48da-5981-8d5c-63dc27e0223d`
 
 **Open tasks:**
 - ! T03 — Live E4 demonstration  `b8f4e3c4`
-  *(wait: No scanned service declares current E: 4, and apps-pg is recorded as E4 unreachable. An owner must name a service that has a per-tenant credential and a separate per-tenant substrate, the credential class (never the value), the other tenant's substrate, the window, the abort contact, and a complete engagement. Tenancy Posture §13 classifies that demonstration as Mechanical. This task authorizes no connection attempt.)*
+  *(wait: Rechecked 2026-10-04: no tenancy.yaml declares E: 4, and apps-pg stays E4-unreachable at E: 0. vergabe-teilnahme is the closest P3-shaped name and does not qualify; its pilot is still a shared apps-pg database. An owner must still name a real per-tenant credential and substrate. This task authorizes no connection. See engagements/2026-10-04-guessed-live-inputs.md.)*
 - ! T04 — Live R4 exercise  `acc22db7`
-  *(wait: R4 evidence is Adversarial. An owner must name the route (horizon-elapsed or key-destroyed), a complete copy inventory covering live data, backups, and derived copies, the erasure horizon, the window, the abort contact, and a complete engagement. audit-core targets R2 and is not this owner. This task authorizes no store access.)*
+  *(wait: Rechecked 2026-10-04: no service has a complete R4 inventory. audit-core stays R2. rapp-postgres ADR-0002 names one WAL stream and one base backup and is not an inventory of derived copies. An owner must still name the route and the inventory. This task authorizes no store access. See engagements/2026-10-04-guessed-live-inputs.md.)*
 - ! T05 — Live V2, V3, or V4 exercise  `3893b7b1`
-  *(wait: V2, V3, and V4 are Adversarial and failure-injected. An operator must name the delivering service, the operation the claim covers, the failure domain, the RTO and RPO, the window, the abort contact, and give the separate approval the rules of engagement §1 require for a recovery probe. V1 stays a mechanical exercise in the declaring service. This task authorizes no failure injection.)*
+  *(wait: Rechecked 2026-10-04: no tenancy.yaml declares V above 1. audit-core V1 for accepting an audit event is a restart and is not V2. No failure domain, RTO, or RPO was guessed. An operator must still approve the exercise. This task authorizes no failure injection. See engagements/2026-10-04-guessed-live-inputs.md.)*
 
 ## Inbox Hygiene