diff --git a/.custodian-brief.md b/.custodian-brief.md
index 750c5ea..76cf170 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,22 +2,29 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-15 23:42 UTC  
+**Last synced:** 2026-07-16 12:26 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Credential disclosure hygiene + rotation guidance (Strand A)
-Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
+Progress: 1/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
 
 **Open tasks:**
-- · Task: Capabilities-based lane verification  `9329e72d`
+- ► Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 - · Task: Safe access transport (no stdout values)  `3f28c573`
 - · Task: Masking display filter (defense-in-depth)  `21ab08d5`
 - · Task: Agent read-boundary on high-risk lanes  `f95d4381`
 - · Task: EXPOSED taint convention  `e989f8f0`
 - · Task: Rotation / re-establishment guidance registry  `b8a43aee`
-- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
+
+### Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
+Progress: 0/3 done  |  workplan_id: `7d697c52-766a-4562-b2ad-a722880bcdcb`
+
+**Open tasks:**
+- ! Task: Executable mass rotation driver  `604aad14`
+- ! Task: Graded lockdown / break-glass with explicit trust-root  `9d004d8f`
+- ! Task: Tamper-evident policy governance + reconcile  `94d5dcaf`
 
 ## Inbox Hygiene