diff --git a/.custodian-brief.md b/.custodian-brief.md
index 2156c33..750c5ea 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,17 +2,27 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-12 23:52 UTC  
+**Last synced:** 2026-07-15 23:42 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Credential disclosure hygiene + rotation guidance (Strand A)
+Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
+
+**Open tasks:**
+- · Task: Capabilities-based lane verification  `9329e72d`
+- · Task: Safe access transport (no stdout values)  `3f28c573`
+- · Task: Masking display filter (defense-in-depth)  `21ab08d5`
+- · Task: Agent read-boundary on high-risk lanes  `f95d4381`
+- · Task: EXPOSED taint convention  `e989f8f0`
+- · Task: Rotation / re-establishment guidance registry  `b8a43aee`
+- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 
 ## Inbox Hygiene
 
 **Stale unread:** 11 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 9 unread message(s) lack supersession chains.
+**Missing thread_id:** 10 unread message(s) lack supersession chains.
 - ! the-custodian: ACTION: railiance01 state-hub deploy for workstream caller migration  `467153f3`
 - ! secrets-engine: Re: Need the warden-sign live apply/handoff (FLEX-WP-0007 T4)  `80456912`