diff --git a/.custodian-brief.md b/.custodian-brief.md
index 30e43d6..fb7d371 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,22 +2,63 @@
 # Custodian Brief — the-custodian
 
 **Domain:** custodian  
-**Last synced:** 2026-05-02 09:37 UTC  
+**Last synced:** 2026-05-02 09:48 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Ad Hoc Tasks — 2026-05-02
+Progress: 1/1 done  |  workstream_id: `3f54ce9c-1f95-42de-894f-0f81a52ba2e8`
+
 ### FOS Hub Bootstrap — Identity, Hub Extraction, Ops Hub, Fin Hub
-Progress: no tasks done  |  workstream_id: `293a74fe-a85a-4ad6-8933-23d52a72fe8b`
+Progress: 1/26 done  |  workstream_id: `293a74fe-a85a-4ad6-8933-23d52a72fe8b`
+
+**Open tasks:**
+- · T01 — Complete NK-WP-0001: Keycloak + privacyIDEA on k3s  `f55078b6`
+- · T02 — Complete NK-WP-0002: Local identity bootstrap  `0d7792f7`
+- · T03 — IAM Profile integration test  `e9894ac9`
+- · T05 — Create hub-core package  `04bf480c`
+- · T06 — Hub-core FastMCP base server  `6b49d94a`
+- · T07 — FOS §10 risk and alert tools  `5a54af24`
+- · T08 — Refactor state-hub to import from hub-core  `daf1d8ac`
+- … and 18 more open tasks
 
 ### Multi-User Onboarding and Environment Bootstrap
-Progress: no tasks done  |  workstream_id: `a28d9e29-4119-4b73-9469-f921920253ef`
+Progress: 0/6 done  |  workstream_id: `a28d9e29-4119-4b73-9469-f921920253ef`
+
+**Open tasks:**
+- · Git credential.helper setup for Gitea access  `71628269`
+- · SSH key generation and authorization automation  `fea965e9`
+- · Claude Code MCP registration for new machines  `60318e9a`
+- · Environment bootstrap script (bootstrap-env.sh)  `84a94761`
+- · Onboarding guide and user journey documentation  `b0839802`
+- · State Hub multi-user model — domain-scoped access  `d5df3302`
 
 ### Migrate Custodian State Hub to ThreePhoenix Cluster
-Progress: no tasks done  |  workstream_id: `967baafb-d92d-405a-ba0b-0d00d37c4940`
+Progress: 0/9 done  |  workstream_id: `967baafb-d92d-405a-ba0b-0d00d37c4940`
+
+**Open tasks:**
+- · T01 — Drill WSL2 backup restore end-to-end  `b0caf112`
+- · T02 — Helm chart for State Hub  `24887dd9`
+- · T03 — Build and push State Hub container image  `79908ade`
+- · T04 — Deploy to cluster and run Alembic migrations  `a7baf2eb`
+- · T05 — Migrate data from WSL2 to cluster  `a307dd46`
+- · T06 — Drill cluster backup restore  `03753b88`
+- · T07 — Cutover: redirect MCP config to cluster  `ff1de25e`
+- … and 2 more open tasks
 
 ### State Hub v0.4 — Workstream Health Index (WHI) KPI Card
-Progress: no tasks done  |  workstream_id: `9cc32158-2f5c-4ef6-9713-aacce4623d5e`
+Progress: 0/9 done  |  workstream_id: `9cc32158-2f5c-4ef6-9713-aacce4623d5e`
+
+**Open tasks:**
+- · P1 — Verify dependency edge fields in open_workstreams  `243646e0`
+- · P2.1 — Build directed dependency graph from openWs + completedIds  `6dbef71f`
+- · P2.2 — Implement DFS cycle detection (CPI)  `f0d5c107`
+- · P2.3 — Compute DD, BR, SPR, PEP, CDDR  `6da60567`
+- · P2.4 — WHI formula: normalization + CPI penalty  `29b2dbbd`
+- · P2.5 — Per-domain WHI breakdown  `8ce5ef74`
+- · P3 — WHI KPI card UI  `91efba5c`
+- … and 2 more open tasks
 
 ---
 ## MCP Orientation (when available)