diff --git a/.custodian-brief.md b/.custodian-brief.md
index 750c5ea..76cf170 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,22 +2,29 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-07-15 23:42 UTC  
+**Last synced:** 2026-07-16 12:26 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Credential disclosure hygiene + rotation guidance (Strand A)
-Progress: 0/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
+Progress: 1/7 done  |  workplan_id: `1adb34af-d5f8-42c5-89b4-44593995a281`
 
 **Open tasks:**
-- · Task: Capabilities-based lane verification  `9329e72d`
+- ► Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
 - · Task: Safe access transport (no stdout values)  `3f28c573`
 - · Task: Masking display filter (defense-in-depth)  `21ab08d5`
 - · Task: Agent read-boundary on high-risk lanes  `f95d4381`
 - · Task: EXPOSED taint convention  `e989f8f0`
 - · Task: Rotation / re-establishment guidance registry  `b8a43aee`
-- · Task: Incident lessons + first worked lane (CCR-2026-0004)  `9944f46d`
+
+### Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
+Progress: 0/3 done  |  workplan_id: `7d697c52-766a-4562-b2ad-a722880bcdcb`
+
+**Open tasks:**
+- ! Task: Executable mass rotation driver  `604aad14`
+- ! Task: Graded lockdown / break-glass with explicit trust-root  `9d004d8f`
+- ! Task: Tamper-evident policy governance + reconcile  `94d5dcaf`
 
 ## Inbox Hygiene
 
diff --git a/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md b/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
index ac716d4..a3aba41 100644
--- a/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
+++ b/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Credential disclosure hygiene + rotation guidance (Strand A)"
 domain: infotech
 repo: ops-warden
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 planning_priority: high
diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
index 9d84342..bf02993 100644
--- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
+++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
@@ -4,13 +4,14 @@ type: workplan
 title: "Tamper-resistant credential governance + mass rotation/lockdown (Strand B)"
 domain: infotech
 repo: ops-warden
-status: backlog
+status: active
 owner: codex
 topic_slug: custodian
 planning_priority: medium
 planning_order: 27
 created: "2026-07-16"
 updated: "2026-07-16"
+state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
 ---
 
 # Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
@@ -61,6 +62,7 @@ path; ops-warden sequences and verifies it.
 id: WARDEN-WP-0027-T01
 status: wait
 priority: high
+state_hub_task_id: "604aad14-d398-4c02-85e5-7ff37a905a1b"
 ```
 
 Turn Strand A's per-lane `rotation:` guidance (WP-0026 T06) into an executable
@@ -81,6 +83,7 @@ each verified capabilities-safe, taint cleared only on success.
 id: WARDEN-WP-0027-T02
 status: wait
 priority: medium
+state_hub_task_id: "9d004d8f-6215-4178-bd13-5785d24fd152"
 ```
 
 Design and document a graded lockdown: (a) soft — deny agent roles read on all
@@ -99,6 +102,7 @@ policy toggles.
 id: WARDEN-WP-0027-T03
 status: wait
 priority: medium
+state_hub_task_id: "94d5dcaf-abf0-417c-a6ef-26e8c50905a8"
 ```
 
 Policy-as-code for OpenBao policies/roles with tamper-evidence: a signed/hashed