diff --git a/.custodian-brief.md b/.custodian-brief.md
index 6e66707..37b9fed 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -1,18 +1,32 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — helix-forge
 
-**Domain:** (unknown)  
-**Last synced:** 2026-06-15 21:03 UTC  
+**Domain:** helix_forge  
+**Last synced:** 2026-06-15 21:05 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Establish ops-hub as the First VSM Inter-Hub Extension
+Progress: 8/10 done  |  workstream_id: `48d91935-197e-4ad4-be07-7bbcd535847c`
+
+**Open tasks:**
+- ! T04 — Create ops-hub API consumer and key  `ad08e729`
+  *(wait: OpenBao pod token helper receives 403 resolving/writing the approved KV path; production Inter-Hub has not deployed the COUNT(*) fix.)*
+- ! T10 — Inter-Hub API hardening for extension bootstrap  `7fa54508`
+  *(wait: Source fix is pushed, but production still runs inter-hub image 5c13de1 and local build/deploy credentials are unavailable in this session.)*
+
+### Expose OpenBao Browser UI at bao.coulomb.social
+Progress: 5/6 done  |  workstream_id: `c1b5f54d-2f26-453d-966c-6353df0b6aec`
+
+**Open tasks:**
+- ! T04 - Add OpenBao UI Redirect URI To platform-admin Role  `4f69cacb`
+  *(wait: Current OpenBao pod token helper receives 403 for sys/auth and auth/netkingdom/role/platform-admin, so this agent cannot verify/update the role.)*
 
 ---
 ## MCP Orientation (when available)
 
 If the state-hub MCP server is reachable, call:
-`get_domain_summary("")`
+`get_domain_summary("helix_forge")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.