diff --git a/.custodian-brief.md b/.custodian-brief.md
index 85f7d5f..b69c6a9 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -1,18 +1,78 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — the-custodian
 
-**Domain:** (unknown)  
-**Last synced:** 2026-05-05 23:02 UTC  
+**Domain:** custodian  
+**Last synced:** 2026-05-05 23:37 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### State Hub Full ThreePhoenix HA Migration
+Progress: 0/8 done  |  workstream_id: `8d0c1b5d-44da-4b91-8357-e6526d3e0a85`
+
+**Open tasks:**
+- · T01 — Confirm ThreePhoenix cluster readiness  `aa1bf291`
+- · T02 — Establish replicated storage/database strategy  `5575f244`
+- · T03 — Implement HA State Hub database  `5330fcc3`
+- · T04 — Add State Hub API high-availability behavior  `64175ed0`
+- · T05 — Drill database failover  `73c5008a`
+- · T06 — Drill backup restore to isolated namespace  `4e5b97ff`
+- · T07 — Update agent access and runbooks for HA endpoint  `959062d8`
+- … and 1 more open tasks
+
+### Pragmatic State Hub Migration to railiance01
+Progress: 2/9 done  |  workstream_id: `967baafb-d92d-405a-ba0b-0d00d37c4940`
+
+**Open tasks:**
+- ► T03 — Build and push State Hub container image  `79908ade`
+- · T04 — Deploy to cluster and run Alembic migrations  `a7baf2eb`
+- · T05 — Migrate data from WSL2 to cluster  `a307dd46`
+- · T06 — Drill cluster backup restore  `03753b88`
+- · T07 — Cutover: redirect MCP config to cluster  `ff1de25e`
+- · T08 — Stabilisation period (2 weeks minimum)  `e06a59a0`
+- · T09 — Retire WSL2 instance  `d75a2d49`
+
+### FOS Hub Bootstrap — Identity, Hub Extraction, Ops Hub, Fin Hub
+Progress: 1/26 done  |  workstream_id: `293a74fe-a85a-4ad6-8933-23d52a72fe8b`
+
+**Open tasks:**
+- · T01 — Complete NK-WP-0001: Keycloak + privacyIDEA on k3s  `f55078b6`
+- · T02 — Complete NK-WP-0002: Local identity bootstrap  `0d7792f7`
+- · T03 — IAM Profile integration test  `e9894ac9`
+- · T05 — Create hub-core package  `04bf480c`
+- · T06 — Hub-core FastMCP base server  `6b49d94a`
+- · T07 — FOS §10 risk and alert tools  `5a54af24`
+- · T08 — Refactor state-hub to import from hub-core  `daf1d8ac`
+- … and 18 more open tasks
+
+### Multi-User Onboarding and Environment Bootstrap
+Progress: 0/6 done  |  workstream_id: `a28d9e29-4119-4b73-9469-f921920253ef`
+
+**Open tasks:**
+- · Git credential.helper setup for Gitea access  `71628269`
+- · SSH key generation and authorization automation  `fea965e9`
+- · Claude Code MCP registration for new machines  `60318e9a`
+- · Environment bootstrap script (bootstrap-env.sh)  `84a94761`
+- · Onboarding guide and user journey documentation  `b0839802`
+- · State Hub multi-user model — domain-scoped access  `d5df3302`
+
+### State Hub v0.4 — Workstream Health Index (WHI) KPI Card
+Progress: 0/9 done  |  workstream_id: `9cc32158-2f5c-4ef6-9713-aacce4623d5e`
+
+**Open tasks:**
+- · P1 — Verify dependency edge fields in open_workstreams  `243646e0`
+- · P2.1 — Build directed dependency graph from openWs + completedIds  `6dbef71f`
+- · P2.2 — Implement DFS cycle detection (CPI)  `f0d5c107`
+- · P2.3 — Compute DD, BR, SPR, PEP, CDDR  `6da60567`
+- · P2.4 — WHI formula: normalization + CPI penalty  `29b2dbbd`
+- · P2.5 — Per-domain WHI breakdown  `8ce5ef74`
+- · P3 — WHI KPI card UI  `91efba5c`
+- … and 2 more open tasks
 
 ---
 ## MCP Orientation (when available)
 
 If the state-hub MCP server is reachable, call:
-`get_domain_summary("")`
+`get_domain_summary("custodian")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.