diff --git a/.custodian-brief.md b/.custodian-brief.md
index ba16a78..fe95e39 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,24 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-06-30 09:34 UTC  
+**Last synced:** 2026-07-01 21:12 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Credential Request and Lease Broker
+Progress: 6/10 done  |  workstream_id: `2731fece-6c49-45b8-ab8a-4ea6c04ac603`
+
+**Open tasks:**
+- ! T05 - Implement secure delivery modes  `66f3cd6d`
+  *(wait: OpenBao live delivery verification pending)*
+- ! T07 - Add flex-auth preflight authorization and State Hub request metadata  `1269bb58`
+  *(wait: Live flex-auth/OpenBao lifecycle evidence pending)*
+- ! T09 - Verification, audit, and red-team checks  `78d1db83`
+  *(wait: Live OpenBao audit evidence pending)*
+- ! T10 - Rollout and migration  `44ce4082`
+  *(wait: Live pilot and external routing rollout pending)*
+
 ### OpenBao Approved Automation Delegation
 Progress: 2/5 done  |  workstream_id: `671898ef-2378-4814-b8f6-066148cdad46`
 
@@ -36,25 +49,6 @@ Progress: 1/7 done  |  workstream_id: `f364d405-a85d-4b89-b600-1964ab436cad`
 - ! T07 - Record lifecycle operations  `130155a5`
 - ► T01 - Review CCR scope and selector naming  `307b75a6`
 
-### Credential Request and Lease Broker
-Progress: 3/10 done  |  workstream_id: `2731fece-6c49-45b8-ab8a-4ea6c04ac603`
-
-**Open tasks:**
-- ! T03 - Configure bounded OpenBao token roles and policies  `d8498e3b`
-  *(wait: OpenBao issuer policy apply denied)*
-- ! T04 - Build credential helper MVP  `0c543cb3`
-  *(wait: OpenBao issuer policy apply denied)*
-- ! T05 - Implement secure delivery modes  `66f3cd6d`
-  *(wait: OpenBao live delivery verification pending)*
-- ! T07 - Add flex-auth preflight authorization and State Hub request metadata  `1269bb58`
-  *(wait: Live flex-auth/OpenBao lifecycle evidence pending)*
-- ! T08 - Integrate ops-warden smoke and routing catalog  `4571d4c9`
-  *(wait: External ops-warden routing update and live smoke pending)*
-- ! T09 - Verification, audit, and red-team checks  `78d1db83`
-  *(wait: Live OpenBao audit evidence pending)*
-- ! T10 - Rollout and migration  `44ce4082`
-  *(wait: Live pilot and external routing rollout pending)*
-
 ---
 ## MCP Orientation (when available)