diff --git a/.custodian-brief.md b/.custodian-brief.md
index ae9c6cb..8180bf3 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,18 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-06-27 23:16 UTC  
+**Last synced:** 2026-06-28 10:40 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Workload KV Access Lanes for ops-warden Fetch
+Progress: 5/7 done  |  workstream_id: `96c8a93d-7a5a-4fa9-8f7b-865119551da3`
+
+**Open tasks:**
+- ► T05 - Verify caller-scoped fetch behavior  `dc1f470b`
+- ► T06 - Coordinate ops-warden catalog activation  `8e84ec19`
+
 ### Credential Change Proposal Review Workflow
 Progress: 3/9 done  |  workstream_id: `4d7ce243-f40a-4249-a46a-a24f75d6fe4c`
 
@@ -47,19 +54,6 @@ Progress: 3/10 done  |  workstream_id: `2731fece-6c49-45b8-ab8a-4ea6c04ac603`
 - ! T10 - Rollout and migration  `44ce4082`
   *(wait: Live pilot and external routing rollout pending)*
 
-### Workload KV Access Lanes for ops-warden Fetch
-Progress: 3/7 done  |  workstream_id: `96c8a93d-7a5a-4fa9-8f7b-865119551da3`
-
-**Open tasks:**
-- ! T03 - Define and apply auth bindings  `a217371a`
-  *(wait: Whynot bound claim/service account not confirmed)*
-- ! T04 - Provision the KV path without exposing the token  `c43724a3`
-  *(wait: NPM_AUTH_TOKEN requires approved operator custody)*
-- ! T05 - Verify caller-scoped fetch behavior  `dc1f470b`
-  *(wait: Live policy role and secret not yet provisioned)*
-- ! T06 - Coordinate ops-warden catalog activation  `8e84ec19`
-  *(wait: Awaiting ops-warden draft catalog wiring and live verification)*
-
 ---
 ## MCP Orientation (when available)