diff --git a/.custodian-brief.md b/.custodian-brief.md
index a427512..dca69a4 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 01:50 UTC  
+**Last synced:** 2026-10-03 07:19 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -44,7 +44,7 @@ Progress: 2/3 done  |  workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8`
 
 **Open tasks:**
 - ! Resolve the credential proxy's admitted policy binding  `8ca28b63`
-  *(wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)*
+  *(wait: Code side done 2026-10-03 (policy.fetch_flex_auth_url). Waits on founder go: deploy access-engine pin flex-auth-ops-warden-fetch, add tunnel flex-auth-ops-warden-fetch-railiance01, set the key in live warden.yaml, then record positive and wrong-owner evidence.)*
 
 ## Inbox Hygiene