diff --git a/.custodian-brief.md b/.custodian-brief.md
index d63f2f8..6ce7807 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-07-01 22:09 UTC  
+**Last synced:** 2026-07-02 10:13 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -16,32 +16,21 @@ Progress: 7/10 done  |  workstream_id: `2731fece-6c49-45b8-ab8a-4ea6c04ac603`
 - ► T09 - Verification, audit, and red-team checks  `78d1db83`
 - ► T10 - Rollout and migration  `44ce4082`
 
-### OpenBao Approved Automation Delegation
-Progress: 4/5 done  |  workstream_id: `671898ef-2378-4814-b8f6-066148cdad46`
-
-**Open tasks:**
-- ► T03 - Add non-production applier role first  `ff927a19`
-
 ### Issue-Core Runtime Ingestion Credential Lane
-Progress: 2/7 done  |  workstream_id: `b059c81d-96f1-451f-896f-a05cd73744a1`
+Progress: 5/7 done  |  workstream_id: `b059c81d-96f1-451f-896f-a05cd73744a1`
 
 **Open tasks:**
-- ! T03 - Apply or confirm least-privilege OpenBao metadata  `e8566cf4`
-- ! T04 - Provision values through approved custody  `4990fe6a`
-- ! T05 - Verify positive and negative access  `65e83572`
 - ! T06 - Activate ops-warden catalog front door  `0d9a02da`
 - ! T07 - Record lifecycle operations  `c85d1139`
 
 ### llm-connect OpenRouter Provider Key Lane
-Progress: 1/7 done  |  workstream_id: `f364d405-a85d-4b89-b600-1964ab436cad`
+Progress: 3/7 done  |  workstream_id: `f364d405-a85d-4b89-b600-1964ab436cad`
 
 **Open tasks:**
-- ! T03 - Apply or confirm least-privilege OpenBao metadata  `42796ef5`
 - ! T04 - Provision the provider key through approved custody  `651f6ec8`
 - ! T05 - Verify positive and negative access  `d538cfc0`
 - ! T06 - Activate ops-warden catalog front door  `376de3fe`
 - ! T07 - Record lifecycle operations  `130155a5`
-- ► T01 - Review CCR scope and selector naming  `307b75a6`
 
 ---
 ## MCP Orientation (when available)