diff --git a/.custodian-brief.md b/.custodian-brief.md
index c173c64..f9df74c 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,18 @@
 # Custodian Brief — flex-auth
 
 **Domain:** infotech  
-**Last synced:** 2026-09-03 21:45 UTC  
+**Last synced:** 2026-09-06 06:04 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### secrets-engine consumer policy package and cluster-local pin
+Progress: 2/5 done  |  workplan_id: `b01f655e-f71a-50ae-b110-178557f07c63`
+
+**Open tasks:**
+- ! 4. Stand up the `flex-auth-secrets-engine` pin  `f4e8709a`
+- ! 5. Hand the pin coordinates back and close  `f0828871`
+- · 3. Confirm the digest join against a real decision record  `8f7e5cdd`
 
 ---
 ## MCP Orientation (when available)