diff --git a/.custodian-brief.md b/.custodian-brief.md
index 60b2672..138aba4 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — flex-auth
 
 **Domain:** infotech  
-**Last synced:** 2026-09-14 02:45 UTC  
+**Last synced:** 2026-09-14 02:48 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -15,12 +15,10 @@ Progress: 2/4 done  |  workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27`
 - · 2. Choose the signature shape and key custody  `5482f3cd`
 
 ### A policy cannot tell a registry fact from a caller assertion
-Progress: 0/3 done  |  workplan_id: `f9a657ce-67b4-5d25-9933-e0fcb2c20b1c`
+Progress: 2/3 done  |  workplan_id: `f9a657ce-67b4-5d25-9933-e0fcb2c20b1c`
 
 **Open tasks:**
 - ! 3. Make the review obligation enforceable rather than written  `8ee5baf9`
-- · 1. Decide the shape  `05c6a85d`
-- · 2. Audit every package for ceilings read from undeclared keys  `fc61c8a7`
 
 ### Admit scoped human review for the three T03 actions
 Progress: 2/3 done  |  workplan_id: `954635b2-8377-5227-ab4f-10607b2a02c6`