diff --git a/.custodian-brief.md b/.custodian-brief.md
index 2156c33..750c5ea 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,17 +2,27 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-12 23:52 UTC  
+**Last synced:** 2026-07-15 23:42 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Credential disclosure hygiene + rotation guidance (Strand A)
+Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
+
+**Open tasks:**
+- · Task: Capabilities-based lane verification  `9329e72d`
+- · Task: Safe access transport (no stdout values)  `3f28c573`
+- · Task: Masking display filter (defense-in-depth)  `21ab08d5`
+- · Task: Agent read-boundary on high-risk lanes  `f95d4381`
+- · Task: EXPOSED taint convention  `e989f8f0`
+- · Task: Rotation / re-establishment guidance registry  `b8a43aee`
+- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 
 ## Inbox Hygiene
 
 **Stale unread:** 11 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 9 unread message(s) lack supersession chains.
+**Missing thread_id:** 10 unread message(s) lack supersession chains.
 - ! the-custodian: ACTION: railiance01 state-hub deploy for workstream caller migration  `467153f3`
 - ! secrets-engine: Re: Need the warden-sign live apply/handoff (FLEX-WP-0007 T4)  `80456912`
 
diff --git a/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md b/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
index 3adfcb6..7725d58 100644
--- a/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
+++ b/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
@@ -11,6 +11,7 @@ planning_priority: high
 planning_order: 26
 created: "2026-07-16"
 updated: "2026-07-16"
+state_hub_workstream_id: "1adb34af-d5f8-42c5-89b4-44593995a281"
 ---
 
 # Credential disclosure hygiene + rotation guidance (Strand A)
@@ -62,6 +63,7 @@ advisory knowledge held next to the routing catalog, not in OpenBao.
 id: WARDEN-WP-0026-T01
 status: todo
 priority: high
+state_hub_task_id: "9329e72d-c07c-41ce-88ce-e8602eb72c43"
 ```
 
 Replace secret-reading verify flows with capability checks. Positive test:
@@ -80,6 +82,7 @@ it (see T07).
 id: WARDEN-WP-0026-T02
 status: todo
 priority: high
+state_hub_task_id: "3f28c573-8e58-4851-8aa0-925f9367f266"
 ```
 
 `warden access` / fetch paths must emit values only into an env var, a file, or
@@ -97,6 +100,7 @@ the anti-pattern is documented fleet-wide.
 id: WARDEN-WP-0026-T03
 status: todo
 priority: medium
+state_hub_task_id: "21ab08d5-7782-4567-a08d-980211dd7851"
 ```
 
 In the warden wrapper, mask KV data values by default when any listing/status is
@@ -112,6 +116,7 @@ limitation documented.
 id: WARDEN-WP-0026-T04
 status: todo
 priority: high
+state_hub_task_id: "f95d4381-f995-4c9d-b438-70b4f0ed90c5"
 ```
 
 **Repo: railiance-platform (OpenBao policy/roles).** Agent identities receive
@@ -129,6 +134,7 @@ while still allowing wrapped/proxied access, verified via capabilities checks.
 id: WARDEN-WP-0026-T05
 status: todo
 priority: medium
+state_hub_task_id: "e989f8f0-930e-4d2f-9037-221e04f34199"
 ```
 
 **Repo: railiance-platform (OpenBao) + ops-warden surface.** Establish a KV v2
@@ -146,6 +152,7 @@ a lane (advisory; no auto-rotation here).
 id: WARDEN-WP-0026-T06
 status: todo
 priority: high
+state_hub_task_id: "b8a43aee-18c7-46cd-9cfe-1f73234746d3"
 ```
 
 Give every catalog lane **structured-but-advisory** renewal guidance, held in the
@@ -165,6 +172,7 @@ every active lane, and the scorecard fails if any active lane lacks guidance.
 id: WARDEN-WP-0026-T07
 status: todo
 priority: medium
+state_hub_task_id: "9944f46d-3706-43a4-9300-7f63bf87c9ff"
 ```
 
 Write a short lessons-learned note (buildup context; exposure accepted; the three