diff --git a/.custodian-brief.md b/.custodian-brief.md
index ed7e3ff..272a80e 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,22 +2,11 @@
 # Custodian Brief — helix-forge
 
 **Domain:** helix_forge  
-**Last synced:** 2026-06-14 22:28 UTC  
+**Last synced:** 2026-06-14 23:00 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Expose OpenBao Browser UI at bao.coulomb.social
-Progress: 0/6 done  |  workstream_id: `c1b5f54d-2f26-453d-966c-6353df0b6aec`
-
-**Open tasks:**
-- · T01 - Decide Browser UI Exposure Boundary  `6f516f34`
-- · T02 - Expose OpenBao UI at bao.coulomb.social  `41e52213`
-- · T03 - Add KeyCape UI Redirect URI  `fc1d5850`
-- · T04 - Add OpenBao UI Redirect URI To platform-admin Role  `4f69cacb`
-- · T05 - Verify Browser Login And Metadata-Only Secret Inspection  `31d1da2d`
-- · T06 - Update Operator Runbooks  `f25bec03`
-
 ### Establish ops-hub as the First VSM Inter-Hub Extension
 Progress: 5/10 done  |  workstream_id: `48d91935-197e-4ad4-be07-7bbcd535847c`
 
@@ -33,6 +22,15 @@ Progress: 5/10 done  |  workstream_id: `48d91935-197e-4ad4-be07-7bbcd535847c`
 - ! T07 — Instrument the current Gitea registry work as the first ops-hub signal  `ed3e0396`
   *(wait: Requires ops widget, active ops event type, and API key before event submission.)*
 
+### Expose OpenBao Browser UI at bao.coulomb.social
+Progress: 2/6 done  |  workstream_id: `c1b5f54d-2f26-453d-966c-6353df0b6aec`
+
+**Open tasks:**
+- ! T05 - Verify Browser Login And Metadata-Only Secret Inspection  `31d1da2d`
+- ► T02 - Expose OpenBao UI at bao.coulomb.social  `41e52213`
+- ► T03 - Add KeyCape UI Redirect URI  `fc1d5850`
+- ► T04 - Add OpenBao UI Redirect URI To platform-admin Role  `4f69cacb`
+
 ---
 ## MCP Orientation (when available)