diff --git a/.custodian-brief.md b/.custodian-brief.md
index fef0491..edca202 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — helix-forge
 
 **Domain:** helix_forge  
-**Last synced:** 2026-06-15 12:44 UTC  
+**Last synced:** 2026-06-15 14:35 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -11,15 +11,17 @@
 Progress: 8/10 done  |  workstream_id: `48d91935-197e-4ad4-be07-7bbcd535847c`
 
 **Open tasks:**
-- ► T04 — Create ops-hub API consumer and key  `ad08e729`
-- ► T10 — Inter-Hub API hardening for extension bootstrap  `7fa54508`
+- ! T04 — Create ops-hub API consumer and key  `ad08e729`
+  *(wait: OpenBao pod token helper receives 403 resolving/writing the approved KV path; production Inter-Hub has not deployed the COUNT(*) fix.)*
+- ! T10 — Inter-Hub API hardening for extension bootstrap  `7fa54508`
+  *(wait: Source fix is pushed, but production still runs inter-hub image 5c13de1 and local build/deploy credentials are unavailable in this session.)*
 
 ### Expose OpenBao Browser UI at bao.coulomb.social
-Progress: 4/6 done  |  workstream_id: `c1b5f54d-2f26-453d-966c-6353df0b6aec`
+Progress: 5/6 done  |  workstream_id: `c1b5f54d-2f26-453d-966c-6353df0b6aec`
 
 **Open tasks:**
-- ► T03 - Add KeyCape UI Redirect URI  `fc1d5850`
-- ► T04 - Add OpenBao UI Redirect URI To platform-admin Role  `4f69cacb`
+- ! T04 - Add OpenBao UI Redirect URI To platform-admin Role  `4f69cacb`
+  *(wait: Current OpenBao pod token helper receives 403 for sys/auth and auth/netkingdom/role/platform-admin, so this agent cannot verify/update the role.)*
 
 ---
 ## MCP Orientation (when available)