diff --git a/.custodian-brief.md b/.custodian-brief.md
index 379b607..b096b8d 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — hub-core
 
 **Domain:** infotech  
-**Last synced:** 2026-09-28 18:22 UTC  
+**Last synced:** 2026-09-28 21:46 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,12 +12,19 @@ Progress: 0/8 done  |  workplan_id: `e61ce290-c5ec-516c-8589-ef9a55cf3aa3`
 
 **Open tasks:**
 - ! T01 — Freeze the integration contract and platform coverage matrix  `204f4fb0`
+  *(wait: Contract reviewers' (NetKingdom, user-engine, tenant-engine, flex-auth) sign-off on the inventory and disputed rows)*
 - ! T02 — Bind platform-root identity, login, tenant and revocation  `9a955fbf`
+  *(wait: NetKingdom/KeyCape live root login, AAL2 enrollment acceptance, and User/Tenant Engine authenticated HTTP readers (contract published in docs/owner-facts-contract.md, no owner endpoint admitted yet))*
 - ! T03 — Deliver root policy and authenticated decision evaluation  `feea8f20`
+  *(wait: flex-auth production PDP deployment and signing-key delivery from platform owners (audit-core-senders routing entry to ops-mason/OpenBao is unresolved; no Hub sender credential minted))*
 - ! T04 — Enforce the boundary across Hub Core and its clients  `15bc3cae`
+  *(wait: T02/T03 live admission; private full-root browser/API/MCP journeys need a real root login and PDP, which do not exist yet)*
 - ! T05 — Admit extensions and State Hub migration callers  `6d29854e`
+  *(wait: T04 live admission)*
 - ! T06 — Prove full platform-root coverage, including Railiance (M1)  `97b0b242`
+  *(wait: T04/T05 live admission and Railiance/platform owners' attended receipts)*
 - ! T07 — Package and gate public exposure  `0c15cb82`
+  *(wait: M1 acceptance; owner: rapp-core-hub via RAPPCOREHUB-WP-0002-T05)*
 - … and 1 more open tasks
 
 ### State Hub inbox freshness and reader cutover