diff --git a/.custodian-brief.md b/.custodian-brief.md
index f6094dc..a380512 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,29 @@
 # Custodian Brief — ops-warden
 
 **Domain:** custodian  
-**Last synced:** 2026-05-15 11:50 UTC  
+**Last synced:** 2026-05-15 13:28 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### OpsWarden Test Coverage and Code Quality
+Progress: 0/6 done  |  workstream_id: `cb2bbf3c-848a-4af6-ba64-8361e64cd4d7`
+
+**Open tasks:**
+- · VaultCA tests  `eff074ce`
+- · LocalCA.generate_keypair tests  `ddfe5331`
+- · CLI tests  `040ce3a1`
+- · Real ssh-keygen integration test  `434fb008`
+- · File permissions enforcement (mode 600)  `ac146fe6`
+- · warden status --state-dir override  `1c9f1987`
+
+### OpsWarden Correctness and Operational Completeness
+Progress: 0/3 done  |  workstream_id: `5a9fba2c-6161-49a4-a231-e750fa4ab572`
+
+**Open tasks:**
+- · TTL max enforcement per ActorType  `b0d0b5f7`
+- · Stale cert cleanup command  `aeeefbad`
+- · Outgoing signatures log  `0194d24f`
 
 ---
 ## MCP Orientation (when available)